PHP - 限制对登录用户的管理页面的访问

Question

I have a table in my database for users, each user has an auth_level (1-3). On my site I have a admin page for adding/deleting new user accounts, I want to restrict access to this page only to users that have an auth level of 3. I have been trying to get this to work with sessions but I am stuck. Hoping someone can help me out.

Here is my code for restricting access. Not sure where I have gone wrong. the check.php start the session.

<?php
require_once('check.php');

//This function returns True if auth level = '3'
//Otherwise it returns False
function CheckAccess()
{
    $result = (isset($_SESSION['SESS_AUTH_LEVEL']) &&  $_SESSION['SESS_AUTH_LEVEL'] == 3 );

    if(!$result)
    {
        header('WWW-Authenticate: Basic realm=“Test restricted area”');
        header('HTTP/1.0 401 Unauthorized');
        return false;
    }
    else
    {
        header("location: admin.php");
    }
}
?>

If I log in as a user with auth level 1 or 3, I get the same blank page.

Answer 1

I think you never call CheckAccess() . Calling it maybe fixes your error.

Answer 2

It's perfectly valid to do the following, which your function is doing.

if (this=that) { /*do multiple*/ } else //do single;

However, it appears you are not calling this function? Try this:

<?php
  require_once('check.php');
  CheckAccess();
?>

Answer 3

You are missing the closing } of your function so all the if statement is seen as part of the method by PHP.

Add a } after $result = and before if

A slightly alternative version that should achieve what you want would be

<?php

function CheckAccess() {
    $result = (isset($_SESSION['SESS_AUTH_LEVEL']) &&  $_SESSION['SESS_AUTH_LEVEL'] == 3 );
    return $result;
}

if (CheckAccess()) {
    header("location: admin.php");
} else {
    header('WWW-Authenticate: Basic realm=“Test restricted area”');
    header('HTTP/1.0 401 Unauthorized');
}

Answer 4

The problem is that there is already output before the headers are send: this need to be changed

<?php
require_once('check.php');
?>

<?php

//This function returns True if auth level = '3'


//Otherwise it returns False
function CheckAccess()
{
...

to this

<?php
require_once('check.php');

//This function returns True if auth level = '3'

//Otherwise it returns False
function CheckAccess()
{
...

because the headers needs to be sent first then the content :)