CodeIgniter 2 and Ion Auth - edit own user account

codeigniter, codeigniter-2, ion-auth, user-accounts

Solution

Unless I'm missing something, I ended up modifying the `edit_user` function within the `auth.php` Controller as follows.

I changed this line which checks to see that the user is "not logged in" OR "not an admin" before dumping them out...

if (!$this->ion_auth->logged_in() || !$this->ion_auth->is_admin())
{
    redirect('auth', 'refresh');
}

...into this, which check to see that the user is "not logged in" OR ("not an admin" AND "not the user") before dumping them out...

if (!$this->ion_auth->logged_in() || (!$this->ion_auth->is_admin() && !($this->ion_auth->user()->row()->id == $id)))

This seems to be working...

- Admin can edit all accounts

- User can only edit his own account

- and somebody not logged in, can't edit any account.

Edit: However, the user also has access to the "groups" setting and could simply put themself into the "admin" group. Not good.

Ion Auth's developer refers to the files he provides as working "examples". Therefore, it's up to the end-developer to edit Ion Auth to suit the needs of the project.

To prevent the user from being able to make himself an "admin" requires a simple change to the `edit_user.php` view file.

Verifies the user is already an "admin" before creating the checkboxes...

<?php if ($this->ion_auth->is_admin()): ?>

    // code that generates Groups checkboxes

<?php endif ?>

Then you'll also need to thoroughly test and adjust as needed. For example, after editing a user profile, you're redirected to the `auth` view. Since the user doesn't have permission to see the `auth` view, there is a "must be an admin" error. In the controller file, you'll have to add the appropriate logic to properly redirect the user when they're not an "admin".

Problem

I am using the latest Ion Auth files along with the latest version of CodeIgniter 2. There is a function called `edit_user` within the `auth.php` Controller file. This function is restricted to use only by members within the "Admin" group, and any Admin member can edit any other member using the function via this URL... ``` /auth/edit_user/id ``` The problem is that I don't see any Controller function or View that allows a regular (non-Admin) user to edit their own account details. Would this be a new Controller function I'd need to write (modify `edit_user` function?) or is this something that Ion Auth should already do? If so, how? Here is the stock Ion Auth `edit_user` function contained within the `auth.php` Controller... ``` function edit_user($id) { $this->data['title'] = "Edit User"; if (!$this->ion_auth->logged_in() || !$this->ion_auth->is_admin()) { redirect('auth', 'refresh'); } $user = $this->ion_auth->user($id)->row(); //process the phone number if (isset($user->phone) && !empty($user->phone)) { $user->phone = explode('-', $user->phone); } //validate form input $this->form_validation->set_rules('first_name', 'First Name', 'required|xss_clean'); $this->form_validation->set_rules('last_name', 'Last Name', 'required|xss_clean'); $this->form_validation->set_rules('phone1', 'First Part of Phone', 'required|xss_clean|min_length[3]|max_length[3]'); $this->form_validation->set_rules('phone2', 'Second Part of Phone', 'required|xss_clean|min_length[3]|max_length[3]'); $this->form_validation->set_rules('phone3', 'Third Part of Phone', 'required|xss_clean|min_length[4]|max_length[4]'); $this->form_validation->set_rules('company', 'Company Name', 'required|xss_clean'); if (isset($_POST) && !empty($_POST)) { // do we have a valid request? if ($this->_valid_csrf_nonce() === FALSE || $id != $this->input->post('id')) { show_error('This form post did not pass our security checks.'); } $data = array( 'first_name' => $this->input->post('first_name'), 'last_name' => $this->input->post('last_name'), 'company' => $this->input->post('company'), 'phone' => $this->input->post('phone1') . '-' . $this->input->post('phone2') . '-' . $this->input->post('phone3'), ); //update the password if it was posted if ($this->input->post('password')) { $this->form_validation->set_rules('password', 'Password', 'required|min_length[' . $this->config->item('min_password_length', 'ion_auth') . ']|max_length[' . $this->config->item('max_password_length', 'ion_auth') . ']|matches[password_confirm]'); $this->form_validation->set_rules('password_confirm', 'Password Confirmation', 'required'); $data['password'] = $this->input->post('password'); } if ($this->form_validation->run() === TRUE) { $this->ion_auth->update($user->id, $data); //check to see if we are creating the user //redirect them back to the admin page $this->session->set_flashdata('message', "User Saved"); redirect("auth", 'refresh'); } } //display the edit user form $this->data['csrf'] = $this->_get_csrf_nonce(); //set the flash data error message if there is one $this->data['message'] = (validation_errors() ? validation_errors() : ($this->ion_auth->errors() ? $this->ion_auth->errors() : $this->session->flashdata('message'))); //pass the user to the view $this->data['user'] = $user; $this->data['first_name'] = array( 'name' => 'first_name', 'id' => 'first_name', 'type' => 'text', 'value' => $this->form_validation->set_value('first_name', $user->first_name), ); $this->data['last_name'] = array( 'name' => 'last_name', 'id' => 'last_name', 'type' => 'text', 'value' => $this->form_validation->set_value('last_name', $user->last_name), ); $this->data['company'] = array( 'name' => 'company', 'id' => 'company', 'type' => 'text', 'value' => $this->form_validation->set_value('company', $user->company), ); $this->data['phone1'] = array( 'name' => 'phone1', 'id' => 'phone1', 'type' => 'text', 'value' => $this->form_validation->set_value('phone1', $user->phone[0]), ); $this->data['phone2'] = array( 'name' => 'phone2', 'id' => 'phone2', 'type' => 'text', 'value' => $this->form_validation->set_value('phone2', $user->phone[1]), ); $this->data['phone3'] = array( 'name' => 'phone3', 'id' => 'phone3', 'type' => 'text', 'value' => $this->form_validation->set_value('phone3', $user->phone[2]), ); $this->data['password'] = array( 'name' => 'password', 'id' => 'password', 'type' => 'password' ); $this->data['password_confirm'] = array( 'name' => 'password_confirm', 'id' => 'password_confirm', 'type' => 'password' ); $this->load->view('auth/edit_user', $this->data); } ```

Original source