if (is_array($role))
{
$roleSQL = “SELECT * FROM `role_perms` WHERE `roleID` IN (” . implode(“,”,$role) . “) ORDER BY `value` DESC”;
} else {
$roleSQL = “SELECT * FROM `role_perms` WHERE `roleID` = ” . floatval($role) . ” ORDER BY `value` DESC”;
}

What I’m doing here is simply ordering the role permissions by ‘allowed’ permissions > ‘denied’ permissions. The array_merge function will then favour the ‘deny’ permissions over the ‘allow’ permissions with the same key.

If you want the opposite behaviour (an ‘allow’ permission in any role overrides a ‘deny’ permission) then change the DESC to ASC.

And if it does, then that is surely a fundamental flaw in the design, since it depends on the roles being ordered manually by ‘most permissions’ > ‘less permissions’ to work as expected. Or am I missing something?

I think the behaviour should be: when any role specifies that a permission is ‘allowed’ then that should take precedence over any other role that specifies it is denied, regardless of the role order. So in practice getRolePerms() should only return permissions where value = 1 (i.e. allowed permissions). Or, you could get rid of the value field altogether since it is redundant.

The alternative would be to use some kind of inheritance for roles, for example a tree structure so that children inherit parent permissions.

where is the logout if i am not wrong (

eg; line 50 in perms.php

if (isset($_GET['action']) == ‘perm’) { //working