Jump to content
I-AM-OBODO

Add Admin Access to All Accounts

Recommended Posts

Hi all,

 

I am wondering how to get this to work or if it is possible. I have an application that was not built with the admin having access to all the users account but now i want it to have access to all accounts.

 

Thanks. (though i've not tried anything yet, just dont know how to start and i dont want to start afresh: advice)

 

My current login code is:

 

 

<?php
    
if(isset($_POST['login'])){

$username = stripslashes($_POST['username']);
$password = stripslashes($_POST['password']);


$stmt = $pdo->prepare("SELECT password FROM tablename WHERE username=:username");
$stmt->bindValue(':username', $username, PDO::PARAM_STR);
$stmt->execute();

if($stmt->rowCount()<1){

echo '<div class="signals"><p class="bg-warning text-center warning"><button type="button" class="close" aria-label="Close"><span aria-hidden="true">×</span></button>INVALID USERNAME OR PASSWORD</div></p>';

}else{

list($hash) = $stmt->fetch(PDO::FETCH_NUM);

if (password_verify($password, $hash)) {
//$_SESSION['username'] = $username;

$status1 = "COMPLETED";
$status2 = "PROCESSING";

//$stmt = $pdo->query("SELECT status FROM ca_confirmed WHERE username ='$_SESSION[username]'");
$stmt = $pdo->query("SELECT status FROM tablename WHERE username ='$username'");
$check = $stmt->fetch(PDO::FETCH_ASSOC);
$status = $check['status'];

$_SESSION['username'] = $username;
if(strcmp($status, $status1) == 0){

header("location: completed/index.php");
exit();
}elseif(strcmp($status, $status2) == 0){

header("location: uncompleted/index.php");    
//exit();
}
}else{
    
echo '<div class="signals"><p class="bg-warning text-center warning"><button type="button" class="close" aria-label="Close"><span aria-hidden="true">×</span></button>INVALID USERNAME OR PASSWORD again</div></p>';

}    
}
}
?>  

Share this post


Link to post
Share on other sites

While I don't fully understand what your code is doing, I do not see anything regarding your initial question. In what way are you currently controlling who accesses what with this code?

Share this post


Link to post
Share on other sites

While I don't fully understand what your code is doing, I do not see anything regarding your initial question. In what way are you currently controlling who accesses what with this code?

 

The code is my login page. currently only the user is able to login from there, but was wondering if i could modify it so that an admin can login into any of the account with a master password

Share this post


Link to post
Share on other sites

It can be done. The site will be role based. Admin from his dashboard can control everything. You need to create a proper database table structure for doing this. 

Share this post


Link to post
Share on other sites

It can be done. The site will be role based. Admin from his dashboard can control everything. You need to create a proper database table structure for doing this.

how can it b done with my login code? that's d issue

Share this post


Link to post
Share on other sites

You're going to need to create a role-based access structure. Basically, you create a new table that stores role name, role level, and role ID. Then add a role ID foreign key column to your user table and use that for comparison. You'll also need to create a method of checking the user access role when that user loads a page - anyone can type an address into the browser's location bar, so once the user is there you have to confirm the fact that they're actually allowed to be there.

 

There's about a million and four debates around the web about handling role-based access systems, so there's no dearth of information or opinion on the matter. Google and spend some time reading.

 

What's below is certainly not the most elegant refactoring of your code, but at it's basest it should get you moving in the right direction.

if(isset($_POST['login']) && !empty(trim($_POST['login']))){
	$username = stripslashes($_POST['username']);
	$password = stripslashes($_POST['password']);
	$stmt = $pdo->prepare("
		SELECT     u.password
                          ,u.status
                          ,r.roleName
                FROM tablename u
                LEFT JOIN tableroles r
                    ON u.roleID = r.ID
                WHERE u.username = :username
	");
	$stmt->bindValue('username', $username, PDO::PARAM_STR);
	$stmt->execute();
	$pg = 'badLogin.php';
	if($stmt->rowCount() === 1){
		$row = $stmt->fetch(PDO::FETCH_OBJ);
		if(!password_verify($password, $row->password)){
			header("location:{$pg}");
			exit;
		}
		$_SESSION['username'] = $username;
		if($row->roleName == 'ADMIN'){
			if($row->status == 'COMPLETED'){
				$pg = 'completed/admin_index.php';
			}else{
				$pg = 'uncompleted/admin_index.php';
			}
		}else{
			if($row->status == 'COMPLETED'){
				$pg = 'completed/index.php';
			}else{
				$pg = 'uncompleted/index.php';
			}
		}
	}
	header("location:{$pg}");
	exit;
}

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.