Admin.php only accessable for logged in members?

Posted: Wed Jul 07, 2004 11:10 am

Hmm, my post doesn't seem to get saved Sad

. I'll try to post it under this one.

[EDIT]

Sorry but it turned out to be my redirection script --> it was in html.

Posted: Wed Jul 07, 2004 11:12 am

I've tried to get this working, but it just doesn't want to. I want admin.php only accessable if you're logged in as a registered user. It's not that hard to evade, but when hackers don't know about it, it might help.

This is what I've done:

After get_lang(admin); I added:

Code:

// Check if user is logged in


    global $user;


   if (!is_user($user)) {

And at the end of the file I made it this:

Code:

// If user is not logged in


   


   }


    else { 


*run a redirection script to index.php*


}





?>

Anyone can help me with this? I really think it's something easy I'm forgetting. Rolling Eyes

Posted: Sat Jul 10, 2004 6:46 am

*bump*

Are you all laughing at my pathetic attempts? Or is this too easy? Help, as always, is much appreciated. Neutral

Site Admin/Owner Joined: Aug 27, 2002 Posts: 17088

You need to check if the user is online, not just if he's a user. You need to check the sessions table to see if he has an active session. If you want to stop those feeble attempts, just install my admin http auth script [ Only registered users can see links on this board! Get registered or login! ] . BTW, in Sentinel 2.0 this will be an option to turn on/off Wink

Posted: Sat Jul 10, 2004 4:39 pm

Raven wrote:

You need to check if the user is online, not just if he's a user.

Thanks for the reply Raven Smile

! But I do just want to check if the visitor is a user. That's enough for me.

I already read that post and I think it's great, but it's also more complicated for the admins I've to train. And believe me, while my site should be safe, it should also be as simple as possible for the other admins, that already have trouble with trying to figure out how to submit news Wink

.

So, how could I just check if the visitor is a logged in user, and if so allow them access, and if not, redirecting them?

Posted: Sat Jul 10, 2004 4:52 pm

I told you how in my previous post Wink

Check the "sessions" table for their username.