A slant on CMS tutorial

[Toxitalk]

I require a cms style login for some work im doing (Its a sort of social networking site) so the tutorial about creating and validating a session user in the write a cms tutorial was great.

Im pretty sure I followed to the letter, my hosting is a vitural machine, running PHP Version 4.4.4-8+etch1 and mysql 5, safe php is off as well as register globals.

Now the issue I had with the php code is that the login script worked fine, but when it redirected to welcome.php something trips out, and it boots the user back to login.

Now for my requirement I just need the php to act as an intial guard dog to varify username and password.

My application will then query other tables to check what a user can do.

With this in mind this is now how the first part of my welcome.php looks

// if (!$theSentry->checkLogin(2) ){ header("Location: login.php"); die(); }
if (!$theSentry->checkLogin(2) ){}

if ($_SESSION['user']=="" OR $_SESSION['pass']=="")
{ header("Location: login.php"); die(); }

Are they any major flaws doing this, as im in a bit of a scrap?

Many thanks

[marzar00]

Hi,

I believe that the Sentry has already covered the check that they are logged in. Have a look in the Sentry.php file around the line 56-83. That code is checking if the user is logged in. That means that you can cut the following out of your page:

PHP Code:

if ($_SESSION['user']=="" OR $_SESSION['pass']=="")
{ header("Location: login.php"); die(); }


Really you should remove this:

PHP Code:

// if (!$theSentry->checkLogin(2) ){ header("Location: login.php"); die(); }
if (!$theSentry->checkLogin(2) ){}

if ($_SESSION['user']=="" OR $_SESSION['pass']=="")
{ header("Location: login.php"); die(); }


And replace it with the default code:

PHP Code:

require_once('../includes/Sentry.php');
$theSentry = new Sentry();
if (!$theSentry->checkLogin(2) ){ header("Location: login.php"); die(); }


Hope this helps,

Marzar

Edit: I just re-read your original post and realised what you are try to do.

The sentry code should redirect the user if they are logged in and are level 2 or 1 in this case. If you want more levels to be allowed access to this page then increase the checkLogin(__) number.