Restrict # pages - Printable Version

The following warnings occurred:

Warning [2] Undefined variable $unreadreports - Line: 26 - File: global.php(961) : eval()'d code PHP 8.2.25 (Linux)

File	Line	Function
/global.php(961) : eval()'d code	26	errorHandler->error
/global.php	961	eval
/printthread.php	16	require_once

Restrict # pages - Printable Version

+- UserSpice (https://userspice.com/forums)
+-- Forum: Support Center (https://userspice.com/forums/forumdisplay.php?fid=23)
+--- Forum: UserSpice 4.3 and Below (https://userspice.com/forums/forumdisplay.php?fid=26)
+--- Thread: Restrict # pages (/showthread.php?tid=756)

Restrict # pages - lordtyla - 09-17-2017

Hiya I am developing a site that uses ajax to load pages, so everything runs off index.php but it just changes the content of the page when you press a navigation button rather than reloading the entire page. I have run into a little problem with restricting these pages

I am trying to restrict http://localhost/#13
I have included the following at the top of the 13.php page:
<pre>

Code:
<?php require_once 'users/init.php'; ?>

<?php if (!securePage($_SERVER['PHP_SELF'])){die();}?>

</pre>

When I go to localhost/13.php it is restricted as intended but if I go to localhost/#13 it is not restricted

Any ideas?

Restrict # pages - Brandin - 09-17-2017

This is because you're calling index.php, not 13.php (I think!)

I would wrap your call in 13.php in ajax with with a checkMenu or hasPerm function.

Restrict # pages - mudmin - 09-17-2017

Yep. That's exactly how I do it.

You don't even have to use the "userspice" page permissions. Just setup the permission levels themselves and then wrap entire php in if/else statements.

There is a description of hasPerm here...

https://userspice.com/documentation-functions/

Restrict # pages - lordtyla - 09-17-2017

Thanks for the replies
[Image: 5G5O3U4.png]

Using the hasPerm function seems to show up as text on the actual webpage (localhost/#13) and it hasn't stoppped me from accessing the page

13.php

<pre>

Code:
<?php require_once 'users/init.php'; ?>

<?php if (!securePage($_SERVER['PHP_SELF'])){die();}?>

<?php if (hasPerm([2],$user->data()->id)){ ?>

<script type="text/javascript">

    $(document).ready(function () {

      $('#doneimg3').fadeIn(1000);

    });

</script>

<script type="text/javascript">

  $(document).ready(function(){   

   $("#redirectvideo").bind('ended', function(){

      location.href="#14";   

   }); 

  });

</script>

<span style="display: none;" id="doneimg3">

<div class="video-background"><video autoplay id="redirectvideo">

    <source src="/video/vaultopen.mp4" type="video/mp4" />

</video></div>

</span>

<div class="row">

    <div class="col-xs-12">

    <div align="center"><a class="btn btn-warning " href="#14" role="button">Skip</a></div>

    </div>

</div>

<?php } ?>

</pre>

Restrict # pages - mudmin - 09-17-2017

Try reversing the logic by killing the page or redirecting somewhere if the user is not logged in or does not have permission first. Here's a an example with die();

Code:
<?php

Code:
if (!$user->isLoggedIn() || !hasPerm([2],$user->data()->id)){

Code:
die();  //or something

Code:
}else{

Code:
//the rest of your script

Code:
?>

Restrict # pages - lordtyla - 09-18-2017

Is this code correctly laid out?
[Image: 8qaej7J.png]

When I load the page it is the same issue as before where the code actually shows up on the page and doesn't function.
[Image: BwgzV0H.png]

Restrict # pages - karsen - 09-19-2017

It seems that for some reason PHP is interpreting

Code:
->

as a closing tag, although I have no idea how that could happen. What version of PHP are you using?