login redirect issue. failed not working

[Jonathan_Fortis]

i am having a problem with a login directing to a failed page if the session variable isnt present.

Basically its a shopping cart that on the checkout page if the user isnt recognised then the page should direct the user to the login.php but the script isnt working. when i am testing different session are being stored in my cache and the checkout page is displaying even if it isnt the correct user and its displaying no user details.

i am using the following

<?php

// *** Logout the current user.

$FF_Logout = $_SERVER['PHP_SELF'] . "?FF_Logoutnow=1";

if (isset($_GET['FF_Logoutnow']) && $_GET['FF_Logoutnow']=="1") {

  if (!session_id()) session_start();

  session_unregister("MM_Username");

  session_unregister("MM_UserAuthorization");

  $FF_logoutRedirectPage = "login.php";

  // redirect with URL parameters (remove the "FF_Logoutnow" query param).

  if ($FF_logoutRedirectPage == "") $FF_logoutRedirectPage = $_SERVER['PHP_SELF'];

  if (!strpos($FF_logoutRedirectPage, "?") && $_SERVER['QUERY_STRING'] != "") {

    $FF_newQS = "?";

    reset ($_GET);

    while (list ($key, $val) = each ($_GET)) {

      if($key != "FF_Logoutnow"){

        if (strlen($FF_newQS) > 1) $FF_newQS .= "&";

        $FF_newQS .= $key . "=" . urlencode($val);

      }

    }

    if (strlen($FF_newQS) > 1) $FF_logoutRedirectPage .= $FF_newQS;

  }

  header("Location: $FF_logoutRedirectPage");

  exit;

}

// do not cache

header ("Expires: Mon, 26 Jul 1997 05:00:00 GMT");                      // Date in the past

header ("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT"); // always modified

header ("Cache-Control: no-cache, must-revalidate");                    // /1.1

header ("Pragma: no-cache");

// *** Restrict Access To Page: Grant or deny access to this page

$FF_authorizedUsers=" ";

$FF_authFailedURL="login.php";

$FF_grantAccess=0;

if (!session_id()) session_start();

if (isset($_SESSION['priorUrl'])) session_unregister("priorUrl");

if (isset($_SESSION["MM_Username"])) {

  if (true || !(isset($_SESSION["MM_UserAuthorization"])) || $_SESSION["MM_UserAuthorization"]=="" || strpos($FF_authorizedUsers, $_SESSION["MM_UserAuthorization"])) {

    $FF_grantAccess = 1;

  }

}

if (!$FF_grantAccess) {

  $priorUrl = "http://".$_SERVER['_HOST'].$_SERVER['SCRIPT_NAME'];

  if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING'] != "") $priorUrl .= "?".$_SERVER['QUERY_STRING'];

  $_SESSION['priorUrl'] = $priorUrl;

  session_register("priorUrl");

  $FF_qsChar = "?";

  if (strpos($FF_authFailedURL, "?")) $FF_qsChar = "&";

  $FF_referrer = "Restricted Area";

  $FF_authFailedURL = $FF_authFailedURL . $FF_qsChar . "accessdenied=" . urlencode($FF_referrer);

  header("Location: $FF_authFailedURL");

  exit;

}

i have had to add a link saying "no contact details or not you?logout and try again"

which isnt ideal.

if i clear the cache it works but again this isnt the idea

[David_Powers]

I haven't been through your code line by line, but surely this should work?

Add the following at the very top of the script:

<?php

session_start();

if (!isset($_SESSION["MM_Username"])) {

    header('Location: login.php');

    exit;

}

?>

[Jonathan_Fortis]

ok i will add this and get back to you as the problem is very difficult to replicate it seems to happen when i have logged into another page

thanks

[Jonathan_Fortis]

ok i have found problem, its happens when i  log into the admin section of the site, if i log into the admin area first then go to the main site and make a purchase it thinks this is the same session then loads the page but obviuosly has no user details

[David_Powers]

In that case, you probably don't need to do anything because a genuine customer won't also be logged in as admin. However, you could change the login and restrict access server behaviors to use an access level. Alternatively, use a different session variable to identify either customers or admins.

[Jonathan_Fortis]

>>>However, you could change the login and restrict access server behaviors to use an access level

can you give me an idea on what i need to do to acheive this?

>>>> Alternatively, use a different session variable to identify either customers or admins.

again what would i need to do?

[David_Powers]

Both the Log In User and Restrict Access to Page server behavior dialog boxes have a radio button that allows you to restrict access based on username and password, or on username, password, and access level. You need to specify the access level in the database.

If you're using Dreamweaver server behaviors for login, everyone is identified as $_SESSION["MM_Username"]. If you want to use a different session variable for administrators, you would need to identify them as $_SESSION['admin'] or something similar. However, this would involve writing your own login script. It sounds as though you probably don't have the knowledge to do so. In that case, I would recommend the first approach.

[Jonathan_Fortis]

ok thanks

[Jonathan_Fortis]

This post was partly resolved but i have some issue, it is rather old but i really hope someone can help

I tried your suggestion of using the restrict access based on level. it works to a certain extent. what is not happening is when the user logs in or is already logged in, the recordset needs to be identified by the session

but none of the information from the recordset is now showing i presume this is due to the wrong variable settings

$colname_rsCustomer = "1";

if (isset($_SESSION["MM_UserAuthorization"])) {

  $colname_rsCustomer = $_SESSION["MM_UserAuthorization"];

}

mysql_select_db($database_lotties, $lotties);

$query_rsCustomer = sprintf("SELECT * FROM LOTTIE_customers WHERE CustomerID = %s", GetSQLValueString($colname_rsCustomer, "int"));

$rsCustomer = mysql_query($query_rsCustomer, $lotties) or die(mysql_error());

$row_rsCustomer = mysql_fetch_assoc($rsCustomer);

$totalRows_rsCustomer = mysql_num_rows($rsCustomer);

i have a column in the database called access and with the following values "user"

the code for restricting the user

// *** Restrict Access To Page: Grant or deny access to this page

$FF_authorizedUsers=" user";

$FF_authFailedURL="login.php";

$FF_grantAccess=0;

if (!session_id()) session_start();

if (isset($_SESSION['priorUrl'])) session_unregister("priorUrl");

if (isset($_SESSION["MM_Username"])) {

  if (false || !(isset($_SESSION["MM_UserAuthorization"])) || $_SESSION["MM_UserAuthorization"]=="" || strpos($FF_authorizedUsers, $_SESSION["MM_UserAuthorization"])) {

    $FF_grantAccess = 1;

  }

}

if (!$FF_grantAccess) {

  $priorUrl = "http://".$_SERVER['_HOST'].$_SERVER['SCRIPT_NAME'];

  if (isset($_SERVER['QUERY_STRING']) && $_SERVER['QUERY_STRING'] != "") $priorUrl .= "?".$_SERVER['QUERY_STRING'];

  $_SESSION['priorUrl'] = $priorUrl;

  session_register("priorUrl");

  $FF_qsChar = "?";

  if (strpos($FF_authFailedURL, "?")) $FF_qsChar = "&";

  $FF_referrer = "Restricted Area";

  $FF_authFailedURL = $FF_authFailedURL . $FF_qsChar . "accessdenied=" . urlencode($FF_referrer);

  header("Location: $FF_authFailedURL");

  exit;

}

thanks in advance