Restrict # pages

[lordtyla]

Hiya I am developing a site that uses ajax to load pages, so everything runs off index.php but it just changes the content of the page when you press a navigation button rather than reloading the entire page. I have run into a little problem with restricting these pages

I am trying to restrict http://localhost/#13
I have included the following at the top of the 13.php page:
<pre>

Code:

<?php require_once 'users/init.php'; ?>
<?php if (!securePage($_SERVER['PHP_SELF'])){die();}?>

</pre>


When I go to localhost/13.php it is restricted as intended but if I go to localhost/#13 it is not restricted

Any ideas?

[Brandin]

This is because you're calling index.php, not 13.php (I think!)

I would wrap your call in 13.php in ajax with with a checkMenu or hasPerm function.

[mudmin]

Yep. That's exactly how I do it.

You don't even have to use the "userspice" page permissions. Just setup the permission levels themselves and then wrap entire php in if/else statements.

There is a description of hasPerm here...

https://userspice.com/documentation-functions/

[lordtyla]

Thanks for the replies

Using the hasPerm function seems to show up as text on the actual webpage (localhost/#13) and it hasn't stoppped me from accessing the page


13.php

<pre>

Code:

<?php require_once 'users/init.php'; ?>

<?php if (!securePage($_SERVER['PHP_SELF'])){die();}?>

<?php if (hasPerm([2],$user->data()->id)){ ?>

<script type="text/javascript">
    $(document).ready(function () {
      $('#doneimg3').fadeIn(1000);
    });
</script>

<script type="text/javascript">
  $(document).ready(function(){  
   $("#redirectvideo").bind('ended', function(){
      location.href="#14";  
   });
  });
</script>

<span style="display: none;" id="doneimg3">

<div class="video-background"><video autoplay id="redirectvideo">
    <source src="/video/vaultopen.mp4" type="video/mp4" />
</video></div>

</span>

<div class="row">
    <div class="col-xs-12">
    
    <div align="center"><a class="btn btn-warning " href="#14" role="button">Skip</a></div>
    
    </div>
</div>

<?php } ?>

</pre>

[mudmin]

Try reversing the logic by killing the page or redirecting somewhere if the user is not logged in or does not have permission first. Here's a an example with die();

Code:

<?php

Code:

if (!$user->isLoggedIn() || !hasPerm([2],$user->data()->id)){

Code:

die();  //or something

Code:

}else{

Code:

//the rest of your script

Code:

?>

[lordtyla]

Is this code correctly laid out?

When I load the page it is the same issue as before where the code actually shows up on the page and doesn't function.

[karsen]

It seems that for some reason PHP is interpreting

Code:

->

as a closing tag, although I have no idea how that could happen. What version of PHP are you using?