The same thing just happened again. I logged in but when forwarded to the admin page I was denied access.
Here is my code:
Header.php
<?
// Check yo see if the user is logged-in
if ($_SESSION['user_group'] == NULL)
{include "login.php";
// Register session username as guest (if not logged-in)
$_SESSION['user_group'] = "guest";
} else {
if ($_SESSION['user_group'] == guest)
{ // Display log-in form if user is not logged-in
include "login.php";
} else {// Show welcome message and log-out link if logged-in
echo "Welcome $_SESSION[username] <a href=\"/$install_dir"; echo "logout.php\"> Log-out</a>";
}
}
?>
post_login.php (the script that proccesses the login form)
<?php
// start the session
session_start();
header("Cache-control: private"); //IE 6 Fix
// Get the user's input from the login form
$name = $_POST['username'];
$pass = $_POST['password'];
// Register session with the inputed value
$_SESSION['username'] = $name;
// Invalid username or password message
$try_again = "Incorrect \"username\" or \"password\"";
// Asign member area paths
$artist_area = "artists/";
$admin_area = "admin/";
// Adslashes to cencel out possible input of " " ''
addslashes($name);
// Include Datatbase connection
include "db.php";
$sql = "SELECT DISTINCT * FROM `users` WHERE `user` = '$name'";
$result = mysql_query($sql);
if (!$result) {
echo "Could not successfully run query ($sql) from DB: " . mysql_error();
exit;
}
// If no rows are found display invalid username or password message
if (mysql_num_rows($result) == 0) {
$_SESSION['username'] = FALSE; //Clear session
echo "<h4 align=center>$try_again</h4><br>
<div align=center><a href='login.php'>Try Again</a></div>";
exit; }
while ($row = mysql_fetch_array($result)){
extract($row);
if (!isset($_POST['submit']))
{
echo "There is a problem please contact the webmaster and quote this ref number (1)";
}
//check if username and passwords are correct
else {
if ($name == $user && $pass == $PASSWORD)
{
//If user is admin forward to the admin directory
if ($user_group == admin){
$_SESSION['user_group'] = admin; //Add user group to session
$_SESSION['user_id'] = $ID; //Add user ID to the session
header("Location: $admin_area"); //Redirect browser
exit;
} else {
if ($user_group == artist){
$_SESSION['artist_name'] = $artist; //Add artist name to session
$_SESSION['user_group'] = artist; //Add user group to session
$_SESSION['user_id'] = $ID; //Add user ID to the session
header("Location: $artist_area"); //Redirect browser
exit; } //end IF $user_group == artist
}
}//end IF $user && $pass
//If invalid username and/or password do the following
else {
//Clear Session Varibles
$_SESSION['username'] = FALSE;
$_SESSION['artist_name'] = FALSE;
$_SESSION['user_group'] = FALSE;
//Print try again
echo "<h4 align=center>$try_again</h4><br>
<div align=center><a href='login.php'>Try Again</a></div>";
}
}//End else if $user && $pass
}//End While extract $row
mysql_free_result($result);
mysql_close($conn);
?>
Admin Area index.php
<?
$page_title = "Admin Area"; //Page Title
include "../../config.php";
include "../../header.php";
include "../../db.php";
// Start -- Hide this page from guests and users
if ($_SESSION['user_group'] == guest){
echo "$no_access";
exit;
}
if ($_SESSION['user_group'] == user){
echo "$no_access";
exit;
}
if ($_SESSION['user_group'] == artist){
echo "$no_access";
exit;
}
?>
