Only allow logged in WordPress Admin to access page (outside of WordPress core)

Question

Background on what I am trying to accomplish... Currently I have created a mini CMS on top of Codeigniter to edit some database stuff for a web app. Right now it is not password protected, since it is still being developed. I want to integrate this into my WordPress installation so that my client does not have to log into the CMS and WordPress.

Where I am so far is:

1. I have created a custom WP admin_menu (via add_menu_page )
2. I have the CMS visible/working in an iframe of the admin menu tab.

What I need to do now is only allow access to these CMS pages if the user is authenticated as a WordPress admin.

In case you are wondering my directory structure:

/ (Codeigniter installed on root)
/blog/ (WordPress Install)
/blog/cms/ (CMS that is talking to Codeigniter)

Thank you in advance!

Update: Since it hasn't been answered in the answers yet, I need to know how to execute WordPress functions outside of the WordPress system.

Answer 1

you probably want to use WordPress's current_user_can() function to confirm the user has at least one capability normally associated with an Admin user, or is a member of the Administrator role.

According to that codex page, this should work to test for an administrator based on role, although I'm not in a position to confirm this sorry. I've certainly used this method in the past to verify user has a given capability.

<?php current_user_can( 'Administrator' ); ?>

EDIT: To authenticate users from a different site to WP, using WP credentials, this answer over on Wordpress.stackexchange describes how to use WP's built in XMLRPC service. The answer is written in the context of authenticating from a servlet, but cOnsumption of the WP XMLRPC service could be implemented in eg JavaScript at the client (rather than between your sites' two separate backends) so might be more useful in your scenario.

The answer includes a pre-written plugin to handle the specific auth request from your remote client at the WP server... But note the comments below the question regarding use of a token instead of passing the creds over the wire (research "nonce" if you're not already familiar with these... WP can created these for you).

Answer 2

I've figured this out. Code below:

define('WP_USE_THEMES', false);
require('../wp-blog-header.php');
if(!is_user_logged_in())
{
    exit('You do not have access');
}