newbie, with problems trying to secure a web search to members only

[firestorm111]

Hi sorry

but I have a small problem in that i have a web site that has a member login area but you can still access the site if not a member in a couple of ways but the main way is through a profile search, is tere anyway i can lock this down  to members only,

[premiso]

By fixing the code, you sure can.

 

We do not know what the potential problems are in the code and thus cannot provide much more information on how to secure your site without code.

[firestorm111]

details of search profile file, i think lol as you will tell i dont have a clue

 

 

<?php /* Smarty version 2.6.18, created on 2009-12-04 20:55:22

        compiled from searchprofile.tpl */ ?>

<?php require_once(SMARTY_CORE_DIR . 'core.load_plugins.php');

smarty_core_load_plugins(array('plugins' => array(array('function', 'html_options', 'searchprofile.tpl', 15, false),)), $this); ?>

<?php echo '<form name="frmQuickSearch" method="get" action="searchmatch.php"><table  cellspacing="2" cellpadding="0" border="0"><tr><td>I am a </td><td>'; ?><?php if ($_SESSION['txtgender']): ?><?php echo ''; ?><?php $this->assign('gender2', $_SESSION['txtgender']); ?><?php echo ''; ?><?php else: ?><?php echo ''; ?><?php $this->assign('gender2', 'M'); ?><?php echo ''; ?><?php endif; ?><?php echo '<select class="searchselect" name="txtgender" style=\'width: 100px\'>'; ?><?php echo smarty_function_html_options(array('options' => $this->_tpl_vars['lang']['signup_gender_values'],'selected' => $_SESSION['txtgender']), $this);?><?php echo '</select></td></tr><tr><td>seeking a </td><td>'; ?><?php if ($_SESSION['txtlookgender']): ?><?php echo ''; ?><?php $this->assign('gender2', $_SESSION['txtlookgender']); ?><?php echo ''; ?><?php else: ?><?php echo ''; ?><?php $this->assign('gender2', 'F'); ?><?php echo ''; ?><?php endif; ?><?php echo '<select class="searchselect" name="txtlookgender" style=\'width: 100px\'>'; ?><?php echo smarty_function_html_options(array('options' => $this->_tpl_vars['lang']['signup_gender_look'],'selected' => $this->_tpl_vars['gender2']), $this);?><?php echo '</select></td></tr><tr><td>who is from </td><td><select class="searchselect" name="txtlookagestart">'; ?><?php echo smarty_function_html_options(array('values' => $this->_tpl_vars['lang']['start_agerange'],'output' => $this->_tpl_vars['lang']['start_agerange'],'selected' => $_SESSION['lookagestart']), $this);?><?php echo '</select> to <select class="searchselect" name="txtlookageend">'; ?><?php echo smarty_function_html_options(array('values' => $this->_tpl_vars['lang']['end_agerange'],'output' => $this->_tpl_vars['lang']['end_agerange'],'selected' => $_SESSION['lookageend']), $this);?><?php echo '</select></td></tr><tr><td colspan="2">who has a photo  <input type="checkbox" name="with_photo" value="1" '; ?><?php if ($_SESSION['with_photo'] == '1'): ?><?php echo 'checked="checked"'; ?><?php endif; ?><?php echo ' /></td></tr><tr><td style="text-align:right;" colspan="2"><input type="submit" value="Search" class="formbutton" /></td></tr></table></form>'; ?>

[mrMarcus]

please format your code (indent, place in code tags, etc.), and then repost it.  just looking at it all condensed like that is giving me a headache.

[firestorm111]

would love to but thats how it is when i copied it and i dont understand anything what so ever about programming or languages, sorry will have to try and find someone local to come and go through it before i do your head in lol, sorry but was worth a try

[PFMaBiSmAd]

A member system works by limiting the access to each page to only logged in members. Therefore, each page you wish to protect must check if the current visitor is a logged in member.

 

It should not matter that someone finds a link to a protected page as the result of a search on your site (the search should filter out links that non-logged in members are not supposed to get in the search result, but even if a member posts a link to a 'secure' page that should not permit a non-logged in visitor from accessing the page just because they possess the URL of that page) because the page each link goes to should check what the current visitor is allowed to have output on that page.

 

If you don't understand what I just wrote and how that relates to the code on your pages that is responsible for limiting access to each page, you should probably hire a programmer to do this work.

[firestorm111]

I should explain a little further as i understand what you are saying, the web site is a dating site that was set up so as anyone could enter and browse around, on the hom page is a search box that gives anyone the ability to search for people that are members, at this stage we now would like to make that you either have to be a member to use that facility or to have to join to use it, and as its a free site its not a financial thing, but understand that it is not as straight forward as i might have made it appear in my post, but thanks for taking the time to reply

[forumforme123]

Maybe you can try using Session to keep track of logged in members.

If non-members try to access protected page, just redirect them to main page or something.