用户未登录时如何限制PHP中的文件浏览？

Question

can you explain why -1? Please dont give me any alternative suggestion..

Im trying to implement a file upload, if the user is not logged in, then restrict the user to browse file instead show login popup.

I have tried like this:

fileupload.php

<script type="text/javascript" src="js/jquery.min.js"></script>
<script type="text/javascript">

function checksession()
{
    var flag_restrict;
    $.ajax({
        type : 'POST',
        url : 'check_session.php',
        async: false,
        success : function(response){
            if(response === "failure")
                flag_restrict = "block";
            else
                alert("login popup code");
        }
    });
    alert(flag_restrict); //displaying nothing;

}

<input type="file" id="browse" name="fileupload" onclick="return checksession();">

check_session.php

session_start();

if($_SESSION['id'] == session_id())
{
    echo "success";
}
else
{
    echo "failure";
}

Problem is when response===failure , file browse is opening, what am I doing wrong, what is correct way to do this?

Answer 1

Your function checksession does not have a return value, it will never prevent the onclick handler to fire. The success handler of your $.ajax() will be executed asynchronously, as the http response from the server was received.

Things you should do (conceptually speaking):

• Only show the upload button when the user is authenticated.
• The onclick handle triggers an upload using ajax (no matter if the user is authenticated)
• The serverside upload action will return a "unauthenticated" if the user is not authenticated.
• If the upload results in a "unauthenticated" message, show the login form.

Answer 2

try this

<input type="file" id="browse" name="fileupload" onclick="return checksession(event);">


    function checksession(e)
{

    $.ajax({
    type : 'POST',
    url : 'check_session.php',
    success : function(response){
                if(response === "failure")
                    e.preventDefault();
                else
                    alert("login popup code");
                }});
}