Restrict Access to Page (k)

Forum|Forum|19 years ago
March 7, 2007
28 replies
2419 views

I know just enough PHP to get myself in trouble.

I'm working on a simple employment section for one of my clients. All
PHP pages work, but now I am trying to make some of them password protected.

I have a table in mySQL with a username and password.

I have a form in a webpage with spaces to write the username and
password. I used the Login User server behavior through Dreamweaver. It
appears to work since the user jumps to the page I want them to instead
of the failure page.

The problem is that once on that page the user gets kicked off. That
page I used the Server Behavior "Restrict Access to Page". Instead of
seeing a valid login, it kicks the user to the page indicated in a
failed login.

Any ideas?

-Kirk

Server side applications

This topic has been closed for replies.

Newsgroup_UserAuthor

Inspiring

W. Kirk Lutz wrote:
> You sir, are a genius!

Well, it's very nice of you to say so, but...

> Creating a simple form only page did the trick. Dreamweaver wrote more
> PHP stuff at the top. It works! Woohoo! It works!

--
David Powers, Adobe Community Expert
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "PHP Solutions" (friends of ED)
http://foundationphp.com/

Newsgroup_UserAuthor

Inspiring

You sir, are a genius!

Creating a simple form only page did the trick. Dreamweaver wrote more
PHP stuff at the top. It works! Woohoo! It works!

Forgive the victory dance.

Thank you very much,
-kirk

David Powers wrote:
> W. Kirk Lutz wrote:
>> Sorry sent a bad link these work:
>
> I've had a quick look, but I'm sorry, I don't have the time to trawl
> through hundreds of lines of code looking for a needle in a haystack.
>
> I suggest that you remove the Log Out link from the listings page and
> test it again. Try building a simple Log In and Log Out system before
> applying it to a page that has such a complex structure.
>

Newsgroup_UserAuthor

Inspiring

Thanks for the help. I'll try just a plain Jane login page (not attached
to a Dreamweaver template) and a plain jane landing page.

-Kirk

David Powers wrote:
> W. Kirk Lutz wrote:
>> Sorry sent a bad link these work:
>
> I've had a quick look, but I'm sorry, I don't have the time to trawl
> through hundreds of lines of code looking for a needle in a haystack.
>
> I suggest that you remove the Log Out link from the listings page and
> test it again. Try building a simple Log In and Log Out system before
> applying it to a page that has such a complex structure.
>

Newsgroup_UserAuthor

Inspiring

W. Kirk Lutz wrote:
> Sorry sent a bad link these work:

I've had a quick look, but I'm sorry, I don't have the time to trawl
through hundreds of lines of code looking for a needle in a haystack.

I suggest that you remove the Log Out link from the listings page and
test it again. Try building a simple Log In and Log Out system before
applying it to a page that has such a complex structure.

--
David Powers, Adobe Community Expert
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "PHP Solutions" (friends of ED)
http://foundationphp.com/

Newsgroup_UserAuthor

Inspiring

Sorry sent a bad link these work:

http://www.redheadcompanies.com/MessageBoard/login.txt

http://www.redheadcompanies.com/MessageBoard/employment_listings.txt

W. Kirk Lutz wrote:
> The news server isn't allowing me to copy my code because it's too big.
>
> So, here are the files in .txt form
>
> http://www.redheadcompanies.com/MessageBoards/login.txt
> http://www.redheadcompanies.com/MessageBoards/employment_listings.txt
>
> -Kirk
>
>
> David Powers wrote:
>> W. Kirk Lutz wrote:
>>> Landing Page after Login:
>>
>> You have shown only the code above the DOCTYPE, but a clue to your
>> problem lies here:
>>
>>> // ** Logout the current user. **
>>
>> According to your earlier description, the login works correctly, but
>> then immediately dumps you back at the login page. It sounds as though
>> something in the body of the page is automatically triggering the Log
>> Out User server behavior.
>>

Newsgroup_UserAuthor

Inspiring

The news server isn't allowing me to copy my code because it's too big.

So, here are the files in .txt form

http://www.redheadcompanies.com/MessageBoards/login.txt
http://www.redheadcompanies.com/MessageBoards/employment_listings.txt

-Kirk

David Powers wrote:
> W. Kirk Lutz wrote:
>> Landing Page after Login:
>
> You have shown only the code above the DOCTYPE, but a clue to your
> problem lies here:
>
>> // ** Logout the current user. **
>
> According to your earlier description, the login works correctly, but
> then immediately dumps you back at the login page. It sounds as though
> something in the body of the page is automatically triggering the Log
> Out User server behavior.
>

Newsgroup_UserAuthor

Inspiring

Newsgroup_UserAuthor

Inspiring

Full Login Page (Part 1):

<?php require_once('../Connections/databaseCONNECT.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "",
$theNotDefinedValue = "")
{
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

$theValue = function_exists("mysql_real_escape_string") ?
mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'"
: "NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue :
$theNotDefinedValue;
break;
}
return $theValue;
}
}

mysql_select_db($database_databaseCONNECT, $databaseCONNECT);
$query_rsPassword = "SELECT * FROM usernamepassword";
$rsPassword = mysql_query($query_rsPassword, $databaseCONNECT) or
die(mysql_error());
$row_rsPassword = mysql_fetch_assoc($rsPassword);
$totalRows_rsPassword = mysql_num_rows($rsPassword);
?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
$_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['Username'])) {
$loginUsername=$_POST['Username'];
$password=$_POST['Password'];
$MM_fldUserAuthorization = "";
$MM_redirectLoginSuccess = "employment_listings.php";
$MM_redirectLoginFailed = "employment_login2.php";
$MM_redirecttoReferrer = false;
mysql_select_db($database_databaseCONNECT, $databaseCONNECT);

$LoginRS__query=sprintf("SELECT Username, Password FROM
usernamepassword WHERE Username=%s AND Password=%s",
GetSQLValueString($loginUsername, "text"),
GetSQLValueString($password, "text"));

$LoginRS = mysql_query($LoginRS__query, $databaseCONNECT) or
die(mysql_error());
$loginFoundUser = mysql_num_rows($LoginRS);
if ($loginFoundUser) {
$loginStrGroup = "";

//declare two session variables and assign them
$_SESSION['MM_Username'] = $loginUsername;
$_SESSION['MM_UserGroup'] = $loginStrGroup;

if (isset($_SESSION['PrevUrl']) && false) {
$MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
}
header("Location: " . $MM_redirectLoginSuccess );
}
else {
header("Location: ". $MM_redirectLoginFailed );
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
" http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns=" http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<META name="Author.Corporate" content="usbiz.com">
<LINK rel="Author.Corporate" href=" http://www.usbiz.com/">
<META name="Publisher" content="Us - Business Systems for Document
Management">
<LINK rel="Publisher" href="mailto:info@usbiz.com">
<META name="keywords" content="Copyworld, Docunet, Us, business systems,
Copiers, Copies, Ricoh, Sharp, HP, office hub, office documents, digital
documents, digital solutions,Standard, Document Management, workflow
analysis, Output solutions, Archiving, Managing, Hardware, Software">
<META name="Description" content="Us is an award winning office
technology leader serving the Central Maryland region. We offer the most
innovative, productive and reliable document management solutions from
the finest manufacturers in the world. Starting with a workflow analysis
to output solutions, including archiving and managaing, we combine the
best hardware, software and services available to improve your document
workflow.">

<title>Us - Business Systems for Document Management - Employment
Login</title>

<style type="text/css">
#AboutUsLayer {
position:absolute;
left:269px;
top:65px;
width:100%;
height:14px;
z-index:5;
background-image: url(images/navigation/subnavigationFILL.gif);
visibility: hidden;
}
#DocumentSolutionsLayer {
position:absolute;
left:269px;
top:65px;
width:100%;
height:14px;
z-index:4;
visibility: hidden;
}
#ProductCenterLayer {
position:absolute;
left:269px;
top:65px;
width:100%;
height:14px;
z-index:3;
visibility: hidden;
}
#CustomerServiceLayer {
position:absolute;
left:269px;
top:65px;
width:100%;
height:14px;
z-index:2;
visibility: hidden;
}
#OnlineStoreLayer {
position:absolute;
left:269px;
top:65px;
width:100%;
height:14px;
z-index:1;
visibility: hidden;
}
</style>
<script type="text/JavaScript">

</script>
<script type="text/javascript">

</script>
<link href="usbiz.css" rel="stylesheet" type="text/css" />
<link rel="shortcut icon"
href=" http://www.redheadcompanies.com/CLIENTS/Copyworld/us/Us16x16.ico"></link>
<link rel="icon"
href=" http://www.redheadcompanies.com/CLIENTS/Copyworld/us/Us16x16.png"
type="image/png"></link>
</head>

Newsgroup_UserAuthor

Inspiring

W. Kirk Lutz wrote:
> Landing Page after Login:

You have shown only the code above the DOCTYPE, but a clue to your
problem lies here:

> // ** Logout the current user. **

According to your earlier description, the login works correctly, but
then immediately dumps you back at the login page. It sounds as though
something in the body of the page is automatically triggering the Log
Out User server behavior.

--
David Powers, Adobe Community Expert
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "PHP Solutions" (friends of ED)
http://foundationphp.com/

Newsgroup_UserAuthor

Inspiring

Landing Page after Login:

<?php require_once('../Connections/databaseCONNECT.php'); ?>
<?php
//initialize the session
if (!isset($_SESSION)) {
session_start();
}

// ** Logout the current user. **
$logoutAction = $_SERVER['PHP_SELF']."?doLogout=true";
if ((isset($_SERVER['QUERY_STRING'])) && ($_SERVER['QUERY_STRING'] != "")){
$logoutAction .="&". htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_GET['doLogout'])) &&($_GET['doLogout']=="true")){
//to fully log out a visitor we need to clear the session varialbles
$_SESSION['MM_Username'] = NULL;
$_SESSION['MM_UserGroup'] = NULL;
$_SESSION['PrevUrl'] = NULL;
unset($_SESSION['MM_Username']);
unset($_SESSION['MM_UserGroup']);
unset($_SESSION['PrevUrl']);

$logoutGoTo = "employment.php";
if ($logoutGoTo) {
header("Location: $logoutGoTo");
exit;
}
}
?>
<?php
if (!isset($_SESSION)) {
session_start();
}
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";

// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) {
// For security, start by assuming the visitor is NOT authorized.
$isValid = False;

// When a visitor has logged into this site, the Session variable
MM_Username set equal to their username.
// Therefore, we know that a user is NOT logged in if that Session
variable is blank.
if (!empty($UserName)) {
// Besides being logged in, you may restrict access to only certain
users based on an ID established when they login.
// Parse the strings into arrays.
$arrUsers = Explode(",", $strUsers);
$arrGroups = Explode(",", $strGroups);
if (in_array($UserName, $arrUsers)) {
$isValid = true;
}
// Or, you may restrict access to only certain users based on their
username.
if (in_array($UserGroup, $arrGroups)) {
$isValid = true;
}
if (($strUsers == "") && true) {
$isValid = true;
}
}
return $isValid;
}

$MM_restrictGoTo = "employment_login.php";
if (!((isset($_SESSION['MM_Username'])) &&
(isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'],
$_SESSION['MM_UserGroup'])))) {
$MM_qsChar = "?";
$MM_referrer = $_SERVER['PHP_SELF'];
if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0)
$MM_referrer .= "?" . $QUERY_STRING;
$MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" .
urlencode($MM_referrer);
header("Location: ". $MM_restrictGoTo);
exit;
}
?><?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "",
$theNotDefinedValue = "")
{
$theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

$theValue = function_exists("mysql_real_escape_string") ?
mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

switch ($theType) {
case "text":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "long":
case "int":
$theValue = ($theValue != "") ? intval($theValue) : "NULL";
break;
case "double":
$theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'"
: "NULL";
break;
case "date":
$theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
break;
case "defined":
$theValue = ($theValue != "") ? $theDefinedValue :
$theNotDefinedValue;
break;
}
return $theValue;
}
}

mysql_select_db($database_databaseCONNECT, $databaseCONNECT);
$query_rsJobs = "SELECT * FROM jobs ORDER BY DateEnteredUpdated DESC";
$rsJobs = mysql_query($query_rsJobs, $databaseCONNECT) or
die(mysql_error());
$row_rsJobs = mysql_fetch_assoc($rsJobs);
$totalRows_rsJobs = mysql_num_rows($rsJobs);

mysql_select_db($database_databaseCONNECT, $databaseCONNECT);
$query_rsStatus = "SELECT * FROM status ORDER BY Status ASC";
$rsStatus = mysql_query($query_rsStatus, $databaseCONNECT) or
die(mysql_error());
$row_rsStatus = mysql_fetch_assoc($rsStatus);
$totalRows_rsStatus = mysql_num_rows($rsStatus);

mysql_select_db($database_databaseCONNECT, $databaseCONNECT);
$query_rsPass = "SELECT * FROM usernamepassword";
$rsPass = mysql_query($query_rsPass, $databaseCONNECT) or
die(mysql_error());
$row_rsPass = mysql_fetch_assoc($rsPass);
$totalRows_rsPass = mysql_num_rows($rsPass);
?>

David Powers wrote:
> W. Kirk Lutz wrote:
>> Anybody? Bueller? Bueller?
>
> What controls access to the page is the PHP code, not the form. Without
> showing the PHP code that has been created, nobody can venture an answer.
>

Show more replies

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded