User Verification

A more efficient way would be to determine the check within the selection menu.

Example:

<div class="menuitem" onmouseover="over(2)" onmouseout="out(2)">
<?
    if($_SESSION['SS_cb_aces_usua']<2)
    {
    echo'<a href="../sai_prin/menu_com_abas_dist.php">Distribuição</a>';
    }
?>
</div>

As you determined in the code, clicking on the distribution would call up a separate menu. In the above cod it does a check showing the data only for those who have got authorization from 0 to 2 (I do not know if it would be from 0 to 5 the number that determines each one.)

You may be creating a access control list , the permissions that the user has based on their profile within the system. A library that provides a framework for this is Zend_Acl .

ACL is made up of three basic functions, they are:

Profile

The following code defines three base profiles - guest , membro and admin - from which other profiles can inherit. Then a profile identified by someuser is established and inherits the other three profiles. The order in which these roles appear in the $parents array is important.

When necessary, Zend_Acl searches for access rules defined not only for the queried profile ( someuser ), but also for profiles from which the consulted profile inherits ( guest membro and admin ):

$acl = new Zend_Acl();

$acl->addRole(new Zend_Acl_Role('guest'))
    ->addRole(new Zend_Acl_Role('member'))
    ->addRole(new Zend_Acl_Role('admin'));

$parents = array('guest', 'member', 'admin');
$acl->addRole(new Zend_Acl_Role('someUser'), $parents);

$acl->add(new Zend_Acl_Resource('someResource'));

$acl->deny('guest', 'someResource');
$acl->allow('member', 'someResource');

echo $acl->isAllowed('someUser', 'someResource') ? 'allowed' : 'denied';

Create the Access Control List

A access control list ( ACL ) can represent any set of physical objects or virtual ones you want. For demonstration purposes, however, we'll create a Basic Content Management System ( CMS ), the ACL, which maintains multiple layers of groups in a wide variety of areas. To create a new object ACL , we will instantiate ACL without parameters:

$acl = new Zend_Acl();

CMS will almost always require a permissions hierarchy to determine the authoring capabilities of your users. There may be a Guest group to allow limited access to demos, a Staff group for most CMS users who perform most day-to-day operations, a group of Editor for publishers, reviewing content archiving and deletion, and finally a Administrador group whose tasks may include all of the other groups, as well as maintaining sensitive information, user management, backup and export.

This set of permissions can be represented in a profile record , allowing each group to inherit privileges from the pai group, as well as providing distinct privileges for only its unique group. Permissions can be expressed as follows:

Forthisexample,Zend_Acl_Roleisused,butanyobjectthatimplementsZend_Acl_Role_Interfaceisacceptable.Thesegroupscanbeaddedtotheregistrationprofileasfollows:

$acl=newZend_Acl();//AdicionagruposparaoperfilderegistrousandoZend_Acl_Role//Oguestnãoherdaoscontrolesdeacesso$roleGuest=newZend_Acl_Role('guest');$acl->addRole($roleGuest);//Staffherdaoguest$acl->addRole(newZend_Acl_Role('staff'),$roleGuest);/*Alternativamente,oacimapodeserescrito:$acl->addRole(newZend_Acl_Role('staff'),'guest');*///EditordeherdadeStaff$acl->addRole(newZend_Acl_Role('editor'),'staff');//Administradornãoherdaoscontrolesdeacesso$acl->addRole(newZend_Acl_Role('administrator'));

NowthattheACLcontainstherelevantprofiles,rulescanbeestablishedthatdefinehowresourcescanbeaccessedbyprofiles.Nospecificresourceshavebeendefinedforthisexample,whichissimplifiedtoillustratethattherulesapplytoallresources.Zend_Aclprovidesanimplementationwhererulesonlyneedtobeassignedfromthegeneraltothespecific,,minimizingthenumberofrulesneeded,becausefeaturesandfunctionsinheritrulesaredefinedovertheirancestors.

Consequently,wecandefineareasonablycomplexsetofruleswithaminimalamountofcode.Toapplythebasepermissionsasdefinedabove:

$acl=newZend_Acl();$roleGuest=newZend_Acl_Role('guest');$acl->addRole($roleGuest);$acl->addRole(newZend_Acl_Role('staff'),$roleGuest);$acl->addRole(newZend_Acl_Role('editor'),'staff');$acl->addRole(newZend_Acl_Role('administrator'));//Somenteguestspodemvisualizaroconteúdo$acl->allow($roleGuest,null,'view');/*Alternativamente,oacimapodeserescrito:$acl->allow('guest',null,'view');//*///Staffherdaoprivilégiodever/viewdeguest,mastambémprecisadeprivilégios//adicionais$acl->allow('staff',null,array('edit','submit','revise'));//Editorherdaosprivilégios"visualizar, editar, enviar", e "revisar" de
// staff, mas também precisa de privilégios adicionais
$acl->allow('editor', null, array('publish', 'archive', 'delete'));

// Administrador não herda nada, mas é permitido todos os privilégios
$acl->allow('administrator');

Consult an ACL

We now have a flexible ACL that can be used to determine if requesters are allowed to perform functions throughout the web application. Querying is quite simple, using the isAllowed() method:

echo $acl->isAllowed('guest', null, 'view') ?
     "allowed" : "denied";
// permitido

echo $acl->isAllowed('staff', null, 'publish') ?
     "allowed" : "denied";
// negado

echo $acl->isAllowed('staff', null, 'revise') ?
     "allowed" : "denied";
// permitido

echo $acl->isAllowed('editor', null, 'view') ?
     "allowed" : "denied";
// permitido por causa da herança de guest

echo $acl->isAllowed('editor', null, 'update') ?
     "allowed" : "denied";
// negado, porque não há nenhuma regra para permitir "update"

echo $acl->isAllowed('administrator', null, 'view') ?
     "allowed" : "denied";
// permitido porque para administrador é permitido todos os privilégios

echo $acl->isAllowed('administrator') ?
     "allowed" : "denied";
// permitido porque para administrador é permitido todos os privilégios

echo $acl->isAllowed('administrator', null, 'update') ?
     "allowed" : "denied";
// permitido porque para administrador é permitido todos os privilégios

Further reading on subject matter:

• Controle de Acesso com Zend_Acl