blui Posted March 28, 2007 Share Posted March 28, 2007 Hi all, I have an admin area which works using sessions, should someone try and go directly to a specific page (e.g. postinfo.php) in the admin area the code should redirect them to the login page (adminloginstart.php) , if the username and password they enter are correct the login page should then redirect them to the original page they requested. The code works fine apart from not redirecting the valid user back to the original requested URL all off the codes in question are listed below, can anyone please help? postinfo.php:- <? require_once('watertonloginc.php'); ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <? require_once('connectionlocal.php'); ?> ------------------------------------------------------------ watertonloginc.php:- <? session_start(); if ($_SESSION['logged'] != 1) { $redirect = $_SERVER['PHP_SELF']; header("Location: adminloginstart.php?redirect=$redirect"); } ?> ------------------------------------------------------------- adminloginstart.php:- <?php session_start(); ob_start(); session_register('logged'); // add single quotes to avoid the constant stuff. $_SESSION['logged'] = 0; ?><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <? $redirect = isset($_POST['redirect'])?$_POST['redirect']:null; // added a check here to avoid the index error. also changed to POST. if (isset($_POST['submit'])) { if ($_POST['username'] == "Paul" && $_POST['password'] == "daleragu")// replace this logic with authorization from mysql if needed {//if it gets to this point, the authorization is correct, the we can redirect with the header 3 lines down $redirect = $_POST['redirect']; $_SESSION['logged'] = 1; header ("Location: $redirect"); } else { ?> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>Untitled Document</title> </head> <body> <table width="502" border="0" align="center" cellpadding="5" cellspacing="0" class="h3"> Invalid Username and/or Password <form action="adminloginstart.php" method="post"> <input type="hidden" name="redirect" value="<? echo $redirect; ?>"> Username: <input type="text" name="username"> Password: <input type="password" name="password"> <input type="submit" name="submit" value="Login"> </form> </table> <? } } else { ?> <table width="502" border="0" align="center" cellpadding="5" cellspacing="0" class="h3"> Invalid Username and/or Password <form action="adminloginstart.php" method="post"> <input type="hidden" name="redirect" value="<? echo $redirect; ?>"> Username: <input type="text" name="username"> Password: <input type="password" name="password"> <input type="submit" name="submit" value="Login"> </form> </table> <? } ?> Link to comment https://forums.phpfreaks.com/topic/44700-authenication-redirect-not-working/ Share on other sites More sharing options...
ultrus Posted March 29, 2007 Share Posted March 29, 2007 Hello blui, I wouldn't be an expert in this topic, but I know that if you send content to the browser before: header("Location: adminloginstart.php?redirect=$redirect"); You will run into problems. Link to comment https://forums.phpfreaks.com/topic/44700-authenication-redirect-not-working/#findComment-217163 Share on other sites More sharing options...
boo_lolly Posted March 29, 2007 Share Posted March 29, 2007 instead of header() use a meta-redirect Link to comment https://forums.phpfreaks.com/topic/44700-authenication-redirect-not-working/#findComment-217198 Share on other sites More sharing options...
btherl Posted March 29, 2007 Share Posted March 29, 2007 Is $redirect set correctly, and correctly encoded? Try printing out its value, and using "view source" to see what it really looks like. You may need to use urldecode() on it. Link to comment https://forums.phpfreaks.com/topic/44700-authenication-redirect-not-working/#findComment-217246 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.