Block pages using login and Session

Question

I’m developing a website that has an administrative panel. That panel has a login, my problem is that I can enter the panel through the link, that is to say, it is not safe, anyone is able to enter if they know the name of the files. Example:

http://localhost/om/admin/Painel.php

If I do this enter me on the site and I can accomplish everything without being administrator, to fix this I know that can be done with Session, but I don’t know how to.

I don’t have any code, I just have a file called _config.php that is being called in all files in the panel.

Answer 1

This problem is very common and it is up to you to define who can access the page or not. The @Carlos example illustrates how to solve the problem.

The logic behind this is: All users have access to all pages of your application, so you must set a level of access to each. In this example above the suggestion was to test if the user has already logged in previously and allow access. If you have not logged in it gives an error message. Many web-sites redirect the user to the login screen again if the user does not have permission.

I recommend reading the function header php. With this function you can redirect the user to another page.

Important remarks:

1. Remember that when using session you should always call the function session_start() before working with the super global variable $_SESSION;
2. When using the function header to redirect a user you must take care not to send any output (output) to the browser, be it a space, a enter, or any HTML tag.

Answer 2

In the file that checks user information, store the user ID in a session.

<?php
session_start(); // Inicia a sessão

// Pega os dados do usuário
$stmt = $con->prepare("SELECT usuarioId FROM usuarios WHERE login = ? AND senha = ?");
$stmt->bind_param('ss', $login, $senha);
$stmt->execute()
$res = $stmt->get_result();

// Verifica se encontrou o usuário
if ($res->num_rows){
    $row = $res->fetch_array(MYSQLI_ASSOC);
    $_SESSION['user'] = $row['usuarioId']; // Marca a global para verificar se o usuário está logado.
    header('Location: http://localhost/sitema/inicio.php'); // Página do sistema
    exit; // Encerra a execução do script
} else {
   // Se não encontrou o usuário, manda de volta para o form de login
   header('Location: http://localhost/sitema/login.php'); // Página do sistema
   exit; // Encerra a execução do script
}

Create the file: restrito.php

<?php
session_start();
// Se o usuário não está logado, manda para página de login.
if (!isset($_SESSION['user'])) header("Location: http://localhost/sistema/login.php");
exit; // Encerra a execução do script

Include the file at the beginning of all pages you want to block for those who are not logged in.

Heed: The archive restrito.php should be the first expression of your page before anything else. Example:

<?php require_once('caminho/para/restrito.php');?><DOCTYPE html>...

You can’t even have one (space) blank before.

Answer 3

I took the liberty of creating this class start that goes against the nominee.

this way in the future will be included all the logic necessary for your project adding a method to class.

Is a start....

class Auth {

    public static function handleLogin(){
        session_start();
        if (!isset($_SESSION['user_logged_in'])) {

            header('location: ' . URL);
            exit();
        }
    }
}

At the beginning of each page just put...

Auth::handleLogin

To be able to work you have to start URL variable for example...

define('URL', 'http://localhost/');

And once credentials are validated you must :

$_SESSION['user_logged_in']=true;

Answer 4

When you log in, you play the information on a Session then on all pages check if there is a Session before displaying the page otherwise redirects to the login.

Note: In case it has not been clear let me know which complement.