Add Admin Access to All Accounts

[I-AM-OBODO]

Hi all,

 

I am wondering how to get this to work or if it is possible. I have an application that was not built with the admin having access to all the users account but now i want it to have access to all accounts.

 

Thanks. (though i've not tried anything yet, just dont know how to start and i dont want to start afresh: advice)

 

My current login code is:

 

 

<?php
    
if(isset($_POST['login'])){

$username = stripslashes($_POST['username']);
$password = stripslashes($_POST['password']);


$stmt = $pdo->prepare("SELECT password FROM tablename WHERE username=:username");
$stmt->bindValue(':username', $username, PDO::PARAM_STR);
$stmt->execute();

if($stmt->rowCount()<1){

echo '<div class="signals"><p class="bg-warning text-center warning"><button type="button" class="close" aria-label="Close"><span aria-hidden="true">×</span></button>INVALID USERNAME OR PASSWORD</div></p>';

}else{

list($hash) = $stmt->fetch(PDO::FETCH_NUM);

if (password_verify($password, $hash)) {
//$_SESSION['username'] = $username;

$status1 = "COMPLETED";
$status2 = "PROCESSING";

//$stmt = $pdo->query("SELECT status FROM ca_confirmed WHERE username ='$_SESSION[username]'");
$stmt = $pdo->query("SELECT status FROM tablename WHERE username ='$username'");
$check = $stmt->fetch(PDO::FETCH_ASSOC);
$status = $check['status'];

$_SESSION['username'] = $username;
if(strcmp($status, $status1) == 0){

header("location: completed/index.php");
exit();
}elseif(strcmp($status, $status2) == 0){

header("location: uncompleted/index.php");    
//exit();
}
}else{
    
echo '<div class="signals"><p class="bg-warning text-center warning"><button type="button" class="close" aria-label="Close"><span aria-hidden="true">×</span></button>INVALID USERNAME OR PASSWORD again</div></p>';

}    
}
}
?>  

[ginerjm]

While I don't fully understand what your code is doing, I do not see anything regarding your initial question. In what way are you currently controlling who accesses what with this code?

[I-AM-OBODO]

While I don't fully understand what your code is doing, I do not see anything regarding your initial question. In what way are you currently controlling who accesses what with this code?

 

The code is my login page. currently only the user is able to login from there, but was wondering if i could modify it so that an admin can login into any of the account with a master password

[Sanjib Sinha]

It can be done. The site will be role based. Admin from his dashboard can control everything. You need to create a proper database table structure for doing this. 

[I-AM-OBODO]

It can be done. The site will be role based. Admin from his dashboard can control everything. You need to create a proper database table structure for doing this.

how can it b done with my login code? that's d issue

[maxxd]

You're going to need to create a role-based access structure. Basically, you create a new table that stores role name, role level, and role ID. Then add a role ID foreign key column to your user table and use that for comparison. You'll also need to create a method of checking the user access role when that user loads a page - anyone can type an address into the browser's location bar, so once the user is there you have to confirm the fact that they're actually allowed to be there.

 

There's about a million and four debates around the web about handling role-based access systems, so there's no dearth of information or opinion on the matter. Google and spend some time reading.

 

What's below is certainly not the most elegant refactoring of your code, but at it's basest it should get you moving in the right direction.

if(isset($_POST['login']) && !empty(trim($_POST['login']))){
	$username = stripslashes($_POST['username']);
	$password = stripslashes($_POST['password']);
	$stmt = $pdo->prepare("
		SELECT     u.password
                          ,u.status
                          ,r.roleName
                FROM tablename u
                LEFT JOIN tableroles r
                    ON u.roleID = r.ID
                WHERE u.username = :username
	");
	$stmt->bindValue('username', $username, PDO::PARAM_STR);
	$stmt->execute();
	$pg = 'badLogin.php';
	if($stmt->rowCount() === 1){
		$row = $stmt->fetch(PDO::FETCH_OBJ);
		if(!password_verify($password, $row->password)){
			header("location:{$pg}");
			exit;
		}
		$_SESSION['username'] = $username;
		if($row->roleName == 'ADMIN'){
			if($row->status == 'COMPLETED'){
				$pg = 'completed/admin_index.php';
			}else{
				$pg = 'uncompleted/admin_index.php';
			}
		}else{
			if($row->status == 'COMPLETED'){
				$pg = 'completed/index.php';
			}else{
				$pg = 'uncompleted/index.php';
			}
		}
	}
	header("location:{$pg}");
	exit;
}