Include/Prepend variation

[klatt]

Hello,

As my system works right now I have a main authentication pages the queries the database to find a user and then sets up a session with that user provided the query was successful.

My problem now is that I would like to be able to use this session info to automatically protect all the rest of the files in the folder, or another folder. I know apache and iis and even php can auto prepend a file, but with my authentication scheme I cannot figure out how that would help me. I know there has to be a simple way to do it but maybe I'm just too tired and have been looking at it too long.

Anyway, here is my code to authenticate other pages once the session has been created. It works but the code for the page must be placed inside php brackets to finish the if statement:

<?php
session_start();

echo '<h1>Members only</h1>';

// check session variable

if (isset($SESSION['valid_user']))
{
echo '<p>You are logged in as '.$SESSION['valid_user'].'</p>';
echo '<p>Members only content goes here</p>';
}
else
{
echo '<p>You are not logged in.</p>';
echo '<p>Only logged in members may see this page.</p>';
}

echo '<a href="authmain.php">Back to main page</a>';
?>

tia,
Frank

[jazz_snob]

I'm not sure what you're after from reading this

My problem now is that I would like to be able to use this session info to automatically protect all the rest of the files in the folder, or another folder. I know apache and iis and even php can auto prepend a file, but with my authentication scheme I cannot figure out how that would help me.

but you could limit access to 'member's only' pages to verified users places those pages behind an .htaccess protected directory thusly ( I don't know how to do this w/ IIS cause I don't do windows )...

<?php
session_start();

if( !isset( $_SESSION['valid_user'] ) )
{
	/* my preference would be to send the user to an 'error' page ala
	header( "Location: /illegal_access.php" ); 
	or you could try... */
	echo '<p>You are not logged in.</p>';
	echo '<p>Only logged in members may see this page.</p>';
	echo '<a href="authmain.php">Back to main page</a>';
	exit();
}
//only valid users get this far...
//include pages behind .htaccess protected directory
?> 

[klatt]

Yah, I know, and I thought about that but for what I am doing it makes much more sense for me to use a DB.

[klatt]

another thought was splitting this file into this part that would be prepended to every file:

<?php
session_start();

echo '<h1>Members only</h1>';

// check session variable

if (isset($SESSION['valid_user']))
{
echo '<p>You are logged in as '.$SESSION['valid_user'].'</p>';
echo '

then the below would be appended to every file.

';
}
else
{
echo '<p>You are not logged in.</p>';
echo '<p>Only logged in members may see this page.</p>';
}

echo '<a href="authmain.php">Back to main page</a>';
?>

This should, as far as I know, work?

[klatt]

Anyone have any ideas? I am having a hard time to get the auto_prepend_file thing to work with .htaccess thru apache.

[klatt]

well this code works:

<?php
session_start();

echo '<h1>Members only</h1>';

// check session variable

if (isset($SESSION['valid_user']))
{
echo '<p>You are logged in as '.$SESSION['valid_user'].'</p>';
?>

<h1>hello all</h1>

<?php
}
else
{
echo '<p>You are not logged in.</p>';
echo '<p>Only logged in members may see this page.</p>';
}

echo '<a href="authmain.php">Back to main page</a>';
?>

BUT, if I try to split this into:

<?php include("header.php") ?>
<h1>hello all</h1>
<?php include("footer.php") ?>

so I dont have to copy and paste the beginning php and ending php portions onto every page I get:

Parse error: syntax error, unexpected $end in C:\klatt\webdocs\header.php on line 12

This is driving me crazy lol.

EDIT: I just found this website:

http://www.theukwebdesigncompany.com/php/manual/modules.php?name=PHP_Manual&page=migration4.parser.html

So, it looks like this is probably not possible anymore (using php5). Any ways to get around this?

[klatt]

Wow I just feel like I keep talking to myself here lol, but I think I fixed it. Ill pust the fix incase anyone else wants it

<?php
session_start();

// check session variable

if (!(isset($SESSION['valid_user'])))
{
//echo '<p>You are logged in as '.$SESSION['valid_user'].'</p>';
exit();
}
?>

Just put that in a file and include it at the beginning of any file you want to protect 🙂

[jazz_snob]

klatt,

I've been tinkering w/ .htaccess for a recent project...however I had to edit httpd.conf to get it to work 🙁

My set up: php 4.3.6 running as Apache module.

For my needs .htaccess goes in / and contains:

AddHandler auth .html
Action auth /authenticate.php

Then, in the httpd.conf:

<Directory />
    AllowOverride FileInfo Options
</Directory>

<?php
//authenticate.php
echo "this is the authentication script";
//grab the url the user was trying to access...
include ( $_SERVER['PATH_TRANSLATED'] );
?>

Yeah, its just a test. Works fine for .html files. I get a 500 error when i added this to .htaccess:

AddHandler auth .php

...because now I've effectively cut-out the PHP handler--oops!...so I had to take that line out and stick w/ the original .htaccess file.

So my current work around is to save my php scripts ( that live under / ) to end in .html ( eg: some_script.php.html ).

YMMV.