#700 Tidy up permissions for various users

[Mark Grimshaw]

Different users have access to doing various operations according to a) their user status and b) the WIKINDX configuration settings.

Checking for access is not centralised and is performed with often complex access checking within various PHP modules. This makes it difficult to debug and track user access issues. It is also the case that some aspects of user access are broken. For example, viewing resource attachments should be available to all registered users, but, if the WIKINDX users configuration for 'Only admins and the resource originator can edit the resource' is set to 'No,' then attachments cannot be viewed (they should be viewable for registered users).

Proposal:

1. Have a lib\USERACCESS class where all access checking is centralised.
2. Access checking is coded in this class for each item that must be checked and FALSE (no access) or TRUE (access granted) is returned for each function.
3. The access should have access to the user type (session) and the WIKINDX configuration variables.

For example, regarding access to attachments:

1. When deciding whether to allow access to viewing attachments, check the return value of:
   $ua->access('viewAttachment')
2. To check whether the user can edit (and add) attachments:
   $ua->access('editAttachment')

RELATED: https://sourceforge.net/p/wikindx/v5bugs/537/

Mark