Hi folks,
We're working on (another) site that needs to authenticate (reasonably easy) and authorise (harder) users in the public web-site. The scenario is this: along with the normal information available to the general public, we also have a number of rubriques that need to be protected. These protected rubriques can only be accessed:
1) by an administrator;
2) by an editor;
3) by a visitor which has been assigned to the rubrique in spip_auteurs_rubriques.
To make things easier for the administrators, I've modified a few of the core files in /ecrire/ to always allow users to be added as visitors (without allowing people to sign themselves up) and to be able to restrict any user to one or more rubriques (rather than only administrators). Add a relatively simple PHP function to query the database tables that this UI maintains and a single <INCLURE> can ensure that only authorised users access it. This all works pretty well (though I anticipate hating the login form just as much as last time).
A slightly trickier requirement is that many visitor accounts will be valid only until a certain date, after which they should automatically disable themselves. I'm writing a plug-in (tentatively called "auteurs_expire" though I'm told this is a bit ugly) to accomplish this task. Currently the plug-in can install/uninstall its database table and add an expandable box to author pages in the back-end though affiche_gauche, though I did have a bit of trouble figuring out how to generate markup that will look like SPIP. The next step is adding the form for the user to enter a date and record it in the database table and then adding the cron task to disable accounts after they expire...
While the documentation on http://doc.spip.net/ and inspecting the source for the Forms et Tables plug-in has been very helpful so far (I'm getting better at interpreting automatically translated English :-), I can't find an example or documentation of the Right Way(TM) to add a form in my expandable box. I looked at a small example (ARNO*'s couleur_rubrique plugin) and saw that it has some code in its _fonctions.php file to check $_POST and save the submitted form values.
I have three questions:
• Is there a tutorial or similar (in English or French) on creating back-end interfaces for plug-ins? I'm particularly interested in using SPIP's built-in AJAX functionality...
• Is there a "better" way to save my form data than just checking if $_POST["my_form_value_name"] is set and saving? This probably ties in with wanting to get AJAX working...
• Is this the sort of plug-in that would be useful to release?
Thanks,
Thomas Sutton
Web Developer
bouncingorange
graphic + web design
Hi Thomas,
I have no answers to your questions but I used the Plugin Acces
Restreint 2.0 for similar purposes, a public website with only one
rubrique only accessed by members of a network.
The Admin can generate visitors in the backend and give them the right
to access to the non-public rubrique. And you have a Login-form on the
front-end site. Perhaps this plugin has all the functionalities you
search....
More information on the plugin can be found at spip-contrib - the
babelfish is your friend 
greetings from Bochum
Heiko
2008/9/9 Thomas Sutton <thomas@bouncingorange.com>
Hi folks,
We're working on (another) site that needs to authenticate (reasonably easy) and authorise (harder) users in the public web-site. The scenario is this: along with the normal information available to the general public, we also have a number of rubriques that need to be protected. These protected rubriques can only be accessed:
1) by an administrator;
2) by an editor;
3) by a visitor which has been assigned to the rubrique in spip_auteurs_rubriques.
To make things easier for the administrators, I've modified a few of the core files in /ecrire/ to always allow users to be added as visitors (without allowing people to sign themselves up) and to be able to restrict any user to one or more rubriques (rather than only administrators). Add a relatively simple PHP function to query the database tables that this UI maintains and a single <INCLURE> can ensure that only authorised users access it. This all works pretty well (though I anticipate hating the login form just as much as last time).
A slightly trickier requirement is that many visitor accounts will be valid only until a certain date, after which they should automatically disable themselves. I'm writing a plug-in (tentatively called "auteurs_expire" though I'm told this is a bit ugly) to accomplish this task. Currently the plug-in can install/uninstall its database table and add an expandable box to author pages in the back-end though affiche_gauche, though I did have a bit of trouble figuring out how to generate markup that will look like SPIP. The next step is adding the form for the user to enter a date and record it in the database table and then adding the cron task to disable accounts after they expire...
While the documentation on http://doc.spip.net/ and inspecting the source for the Forms et Tables plug-in has been very helpful so far (I'm getting better at interpreting automatically translated English :-), I can't find an example or documentation of the Right Way(TM) to add a form in my expandable box. I looked at a small example (ARNO*'s couleur_rubrique plugin) and saw that it has some code in its _fonctions.php file to check $_POST and save the submitted form values.
I have three questions:
• Is there a tutorial or similar (in English or French) on creating back-end interfaces for plug-ins? I'm particularly interested in using SPIP's built-in AJAX functionality...
• Is there a "better" way to save my form data than just checking if $_POST["my_form_value_name"] is set and saving? This probably ties in with wanting to get AJAX working...
• Is this the sort of plug-in that would be useful to release?
Thanks,
Thomas Sutton
Web Developer
bouncingorange
graphic + web design
_______________________________________________
spip-en@rezo.net - http://listes.rezo.net/mailman/listinfo/spip-en
Hi Heiko,
Thanks for the reply.
On 09/09/2008, at 1:56 PM, Heiko Jansen wrote:
Hi Thomas,
I have no answers to your questions but I used the Plugin Acces
Restreint 2.0 for similar purposes, a public website with only one
rubrique only accessed by members of a network.
The Admin can generate visitors in the backend and give them the right
to access to the non-public rubrique. And you have a Login-form on the
front-end site. Perhaps this plugin has all the functionalities you
search....
More information on the plugin can be found at spip-contrib - the
babelfish is your friend
Babelfish doesn't seem to like spip-contrib.net, but Google Translate works fine (and also translates quite well). I do need to make more of an effort to check spip-contrib.net... 
Plugin Acces Restreint takes a much better approach than modifying the templates to check user authorisation (and then hoping that you haven't forgotten anything). I'll try it out immediately and if it works, I won't need to modify core SPIP files. Great!
Alas, I still need to disable user accounts after they run out of time, so I still need to write my plug-in. I shall keep looking...
Le plugin Accès Restreint - SPIP-Contrib
Accès restreint V2 - Les objectifs - SPIP-Contrib
Thanks,
Thomas Sutton
bouncingorange