Controlling page access with UserDB

### Index Up <<

## Controlling page access with UserDB

You can implement a simple access control scheme with the MiniVend user database. Controlled pages must reside in a directory which has a file named `.access` that is zero bytes in length. (If it is more than 0 bytes, then only the RemoteUser or MasterHost may access files in that directory.)

Set the following variables in `catalog.cfg`:

        Variable   MV_USERDB_ACL_TABLE  userdb
        Variable   MV_USERDB_ACL_COLUMN acl

The `MV_USERDB_ACL_TABLE` is the table which controls access, and likewise the `MV_USERDB_ACL_TABLE` names the column in that database which will be checked for authorization.

The database entry should contain the complete MiniVend-style page name of the page to be allowed. It will not match substrings.

For example, if the user `flycat` followed this link:

        <A HREF="[area cartcfg/master_edit]">Edit</A>

Access would be allowed if the contents of the userdb were:

        code    acl
        flycat  cartcfg/master_edit

and disallowed if it were:

        code    acl
        flycat  cartcfg/master_editor

You can enable access with:

        [userdb function=set_acl location="cartcfg/master_edit"]

and disallow access with:

        [userdb function=set_acl
                delete=1
                location="cartcfg/master_edit"]

Of course a pre-existing database with the ACL values will work as well; it need not be in the UserDB setup.

### Index Up <<