AUTH: 2 areas for different user types. All use AUTH. How to prevent them accessing each other's areas?
| From: | l Burnerheimerton | Date: | Mon, 12 Sep 2005 15:00:13 +0000 |
| Subject: | AUTH: 2 areas for different user types. All use AUTH. How to prevent them accessing each other's areas? | ||
| Groups: | php.pear.general | ||
| Request: | Send a blank email to pear-general+get-20925@lists.php.net to get a copy of this message | ||
I have two different types of users: business_user,
admin_user.
The admins's pages are in /admins/**
The business pages are in /business_user/**
Each has separate but similar login pages with
something like:
$opts = array('table' => 'admins', 'usernamecol' =>
'userID','dsn' =>
'mysql://userID:password@localhost/dbname',
'db_fields' => 'location_ID, firstName, lastName,
user_ID');
I then assign a session var to each user with the
above information obtained from AUTH in addition to
their role - administrative_user or business_user.
The problem happens when I login as admin_user then go
to /business_user/index.php. As the admin_user, I
should be rediredted to a login page because I
require_once a file like the following:
require 'Auth/Auth.php';
$opts = array('table' => 'business_user',
'usernamecol' => 'ID',
'dsn' => 'mysql://userID:password@localhost/dbname');
$a = new Auth('DB',$opts);
$a->setShowLogin(false);
$a->start();
If (! $a->getAuth()) {
header("Location: login.php");
exit();
}
Bu ti am NOT. I am allowed access to that page. I
could check $_SESSION variables but would rather get
this working since AUTH has been tested thoroughly.
Please let me know what I am doing wrong. Thanks.
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com