PHP Generic Access Control Lists

Open Source Time and Attendance, Job Costing and Payroll!
Proud Sponsor of phpGACL

Latest Version:

05-Sep-06 - v3.3.7

Get it here!

This release contains several minor bug fixes since v3.3.6, an improved installer, and updated ADODB and Smarty packages.

03-Dec-05 - v3.3.6

Get it here!

This release contains several bug fixes since v3.3.5.

03-Sep-05 - v3.3.5

Get it here!

This release contains a configuration file for all phpGACL related settings and several bug fixes. Upgraded Smarty, and ADODB.

08-Dec-04 - v3.3.4

Get it here!

Many bug fixes and speed optimizations. API improvements. API guide added, documentation improved, and a Star Wars Millennium Falcon tutorial included. Upgraded Cache_Lite, Smarty, and ADODB.

Summary:

A PHP class offering Web developers a simple, yet immensely powerful "drop in" permission system to their current Web based applications.

Features:

Split into two classes, and a seperate administration interface.
1. GACL class: Designed to be very small (517 lines of code including comments) and very fast, this class strictly takes care of the permission checks.
2. GACL_API class: Designed to be robust and flexible, this class takes care of creating/editing/deleting objects, groups and ACLs.
3. phpGACL Administration Interface: A set of scripts that allow for the easy administration of the entire GACL universe using only your browser.
NOT limited to typical "read/write/execute" permissions similar to some flavours of *nix
User definable "Access Control Objects" (ACO). These are objects which control what access is available to "requesters" (see below).
Several examples:
Enable - Projects
View - Projects, View Own - Projects
Edit - Projects, Edit Own - Projects
Delete - Projects, Delete Own - Projects, UnDelete - Projects, UnDelete Own - Projects
Add - Projects
System down for Maintenance
View - The letter "e" ;)
User definable "Access Request Objects" (ARO). These are objects which request access from an "Access Control Object" (above) examples would be:
Users/Accounts
IP Addresses
Browsers/Browser capabilities (JS/Flash/DHTML)
User definable "Access eXtension Objects" (AXO). These are objects which extend permissions to a 3rd layer, optionally allowing you to set fine grained permissions on each individual item in your application, or even row in your database. AXO's are often used in cases where you only want to give a user access to a specific project or contact.
Several examples:
Projects - Project ID: 3474 (Accounting Software)
Projects - Project ID: 3484 (Financial Software)
Contacts - Contact ID: 4775 John Doe
Contacts - Contact ID: 4795 John Doe
Tree based ARO/AXO Object grouping with inheritance.
Example:
```
Root
|- Staff            ( ALLOW [View Own - Projects], ALLOW [Add - Projects], ALLOW [Edit Own - Projects] )
|  |- Facilitators  ( DENY  [Add - Projects] )
|  |- Managers      ( ALLOW [Edit - Projects] )
|  '- Executives    ( ALLOW [Edit - Projects], ALLOW [Delete - Projects] )
'- Customers
   |- VIP
   |- Regular
   '- Annoying      ( DENY  [ALL] )
```
In the above example (assume DENY ALL by default) because of inheritance, we gave the Staff group permission to several ACO's, now any child group has access to those same permissions plus any additional ones assigned. So even though the entire Staff group and all its children groups have permission to "Add - Projects", Facilitators are denied that right. Only Managers and Executives however are granted permission to "Edit - Projects" and only Executives are granted permission to "Delete - Projects".
Contains functionality to easily program add-ons. Examples would be for product pricing, or quantity limitations.
Example:
```
Root
'- Customers
   |- Bronze Package ( Add - Projects [Limit 5, Price $10/each] )
   |  '- John Doe ( Exception to group: Add - Projects [Limit 8, Price $9/each] )
   |- Silver Package ( Add - Projects [Limit 10, Price $5/each] )
   '- Gold Package ( Add - Projects [Limit 20, Price $2/each] )
```
In the above example, we set group "defaults" for each of the three packages, however the real world usually doesn't work that way,

Customers always make outlandish demands, so let's satisfy them, John Doe wanted more then 5 projects, but not quite 10, so we simply put in an exception for just him, and gave him a slight discount on the price to keep yet another satisfied customer!
One function application integration: acl_check()
Simply pass this function four parameters, it doesn't get any easier!
Supports the most popular databases using the ADODB database abstraction layer. (MySQL, PostgreSQL, Oracle, MSSQL)
Complete web based administration interface.
Scalable. A real-world working version with many added layers of complexity supports over 60,000 Accounts, 200 Groups and 300 ACO's.

Requirements:

PHP 4.x or greater
SQL database. (MySQL 3x/4.0.15+, PostgreSQL 7.2+, Oracle 9i+, MS-SQL 2000+)

Example Uses:

Groupware applications
Message boards/Forums (moderators, admins, etc...)
News applications (editors, admins, etc...)
Bug tracking / Ticketing applications
Any application that requires logins!

Downloads:

Grab the latest version here!

Mailing Lists:

Join the mailing lists, click here.

phpGACL - Generic Access Control Lists

phpGACL