Sorry for the delay.

I get no errors when logged in either as admin or non-admin with the following at the top of the page:

<?php
    if (!defined('START_SESSION')) { define('START_SESSION', true); }
  // load viewer library
  $libraryPath = 'cmsAdmin/lib/viewer_functions.php';
  $dirsToCheck = array('/hsphere/local/home/a12345/my_site.com/','','../','../../','../../../');
  foreach ($dirsToCheck as $dir) { if (@include_once("$dir$libraryPath")) { break; }}
  if (!function_exists('getRecords')) { die("Couldn't load viewer library, check filepath in sourcecode."); }
 
//Get the current CMS users details
  $CMS_USER = getCurrentUserFromCMS();
 
  //redirect the browser if no user is currently logged into the back end
  if (!@$CMS_USER['num']){
    session_unset();
    redirectBrowserToUrl("http://elleschorrphotography.com/cmsAdmin/admin.php?redirectUrl=" . $_SERVER['REQUEST_URI']);
    exit;
  }
 
?>

And this in the body:

<?php if( $CMS_USER['isAdmin']): ?>
Code for admins...
      <?php elseif( !$CMS_USER['isAdmin']): ?> :?>

      Sorry, you're logged in but you're not an admin...

      <?php else :?><?php else :?>

       Sorry, based on the login credentials you used, you don't have the authority to access this page. <br />
      <br />
      To log in with the appropriate credentials, <a class="special" href="http://www.my_site.com/cmsAdmin/admin.php?action=logoff">Click Here to Log Out</a>, then return to this page and log in again.<br />
     
      <?php endif ?>


Again, thanks for all your help,

Jerry Kornbluth

Can you let me know what error you get when you log in as a non admin?

Thanks

He came up with this solution. He said,

“For some reason the server was creating two different sessions depending on if you are logged in at http://your_site.com/ or http://www.your_site.com. As the log off link was to www.your_site.com this was causing an issue if the user had logged in at the non www version. I've got around the problem by adding a rule to your htaccess file that redirects all site visitors to your_site.com. I've also added the session_unset to the if statement that checks if the user is logged in, as this should completely destroy the session.”

The .htaccess rule is:


# Redirect www urls to non-www
RewriteEngine on
RewriteCond %{HTTP_HOST} ^www\.your_site\.com [NC]
RewriteRule (.*) http://your_site.com/$1 [R=301,L]


The viewer code including the session_unset code is:

<?php
    if (!defined('START_SESSION')) { define('START_SESSION', true); }
  // load viewer library
  $libraryPath = 'cmsAdmin/lib/viewer_functions.php';
  $dirsToCheck = array('/path_to_your_server/','','../','../../','../../../');
  foreach ($dirsToCheck as $dir) { if (@include_once("$dir$libraryPath")) { break; }}
  if (!function_exists('getRecords')) { die("Couldn't load viewer library, check filepath in sourcecode."); }
 
//Get the current CMS users details
  $CMS_USER = getCurrentUserFromCMS();
 
  //redirect the browser if no user is currently logged into the back end
  if (!@$CMS_USER['num']){
    session_unset();
    redirectBrowserToUrl("http://your_site.com/cmsAdmin/admin.php?redirectUrl=" . $_SERVER['REQUEST_URI']);
    exit;
  }
 ?>

In the body of my viewer to separate access to the code for users and the code for admins:

<?php if( $CMS_USER['num']): ?>
 <a class="special" href="http://your_site.com/cmsAdmin/admin.php?action=logoff">Click Here to Log Out</a><br /><br />
Code for any user...
      <?php endif ?>
<br />
 <?php if( $CMS_USER['isAdmin']): ?>
Code for admins only...
<?php endif ?>

Hope Greg's solution helps someone else.

Jerry Kornbluth

I've submitted a 2nd level request.

the file that I've been testing with is publicitya.php

Jerry Kornbluth

Could you fill out a second level support request for me so that I can login to the CMS area and recreate the issue? You can find the form here:

https://www.interactivetools.com/support/email_support_form.php

Thanks!

Greg

Sorry for the delay.

That added line didn't destroy the login session

I've attached the page code and the 2 cookies that are generated when a non-Admin user logs in. cms_5159ca3da2187_loginsession and cms_5159ca3da2187_PHPSESSION.

Thanks,

Jerry Kornbluth

Could you add some code to destroy the session data if the user isn't logged in your if statement?

 <?php if($CMS_USER['isAdmin']): ?>
   code for admins only...
<?php else :?>
   <?php unset($_SESSION['otherSessonVariable']); ?>
   Sorry, based on the login credentials you used, you don't have the authority to access this page.
   <br />
   <br />
   To log in with the appropriate credentials, <a class="special" href="http://www.elleschorrphotography.com?action=logoff">Click Here to Log Out</a>, then return to this page and log in again.<br /> </span>
<?php endif ?>

If this doesn't work, could you post all of your code so far so I can see what is being stored in the non-admin session?

Cheers

Greg

<?php if($CMS_USER['isAdmin']): ?>

code for admins only...

 <?php else :?>
     
Sorry, based on the login credentials you used, you don't have the authority to access this page.

<br />
<br />
To log in with the appropriate credentials, <a class="special" href="http://www.elleschorrphotography.com?action=logoff">Click Here to Log Out</a>, then return to this page and log in again.<br /> </span>

<?php endif ?>

It is perfect!

It is also independent of activation on False or True.

Thanks again!

Djulia

Sorry, but I'm not 100% sure where you want non admin users to be taken if they don't have access to the page, should they be redirected to the admin area? Should people who aren't logged in also be redirected to the CMS area? If you're trying to send non admin users to the CMS area to log in, this should work:

  //Get the current CMS users details
  $CMS_USER = getCurrentUserFromCMS();
  //redirect the browser if no user is currently logged into the back end
  if (!@$CMS_USER['isAdmin']){
     redirectBrowserToUrl("http://elleschorrphotography.com/cmsAdmin/admin.php");
    exit;
  }

Thanks!

Greg

Sorry that this is becoming so complex and time consuming.

I think we're getting further off base with my NON membership plugin issue. (Djulia had the membership plugin issue, and I'll follow up on that later)

The code you offered a few posts back:

//Get the current CMS users details
  $CMS_USER = getCurrentUserFromCMS();
 
  //redirect the browser if no user is currently logged into the back end
  if (!@$CMS_USER['num']){
    redirectBrowserToUrl("http://elleschorrphotography.com/cmsAdmin/admin.php?redirectUrl=" . $_SERVER['REQUEST_URI']);
    exit;
  }

Works fine.

It's only when I try to restrict to admins only, by changing

if (!@$CMS_USER['num'])

To

if (!@$CMS_USER['isAdmin'])

and then log in as a non-admin user that I get back into the loop issue. (logging in as an Admin works fine)

If I use your latest idea, the user is taken back into the back end which is not what I'm trying to do.

Hope that clarifies the problem.

Thanks,

Jerry Kornbluth

I think I've found out what the problem is, it looks as if  your code is creating an infinite redirect loop. publicity.php is forwarding to the cmsAdmin area, then CMS Builder is detecting the redirectUrl variable in the URL, and redirecting back to publicity.php, which then redirects back to the CMS Admin area, etc. I would remove the redirectUrl variable from the publicity.php redirect:

  //Get the current CMS users details
  $CMS_USER = getCurrentUserFromCMS(); 
  
  //redirect the browser if no user is currently logged into the back end
  if (!@$CMS_USER['num']){ 
    redirectBrowserToUrl("http://elleschorrphotography.com/cmsAdmin/admin.php");
    exit;
  }

@Djulia,

I've done some quick testing in version 2.53. Have you got the WSM_SEPARATE_LOGIN global set to true in your website membership plugin? If not you can change it on line 33 of websiteMembership.php:

$GLOBALS['WSM_SEPARATE_LOGIN']            = true;         // set this to allow you to login to the website and CMS simultaneously as different users

The test code below should output the front end and CMS user array details:

<?php header('Content-type: text/html; charset=utf-8'); ?>
<?php
  /* STEP 1: LOAD RECORDS - Copy this PHP code block near the TOP of your page */
  
  // load viewer library
  $libraryPath = 'cmsAdmin/lib/viewer_functions.php';
  $dirsToCheck = array('C:/wamp/www/','','../','../../','../../../');
  foreach ($dirsToCheck as $dir) { if (@include_once("$dir$libraryPath")) { break; }}
  if (!function_exists('getRecords')) { die("Couldn't load viewer library, check filepath in sourcecode."); }


  $CMS_USER = getCurrentUserFromCMS(); 

  showme($CMS_USER);

  showme($CURRENT_USER);

Thanks!

Greg

Thanks!

Djulia

Thanks for discovering that. It seems to work.

One more question...

When I try to restrict access to admins by changing !@$CMS_USER ['num'] to !@$CMS_USER ['isAdmin'], if I log in as an admin the redirect works as it's supposed to, but if I log in as a non Admin it crashes with the same error as before.

Any thoughts?

Thanks,

Jerry Kornbluth

Sorry for a delay in the reply. 

I've just discovered there is a new function you can use to get the current CMS user, and it works if you don't have the website membership plugin:

  //Get the current CMS users details
  $CMS_USER = getCurrentUserFromCMS(); 
  
  //redirect the browser if no user is currently logged into the back end
  if (!@$CMS_USER['num']){ 
    redirectBrowserToUrl("http://elleschorrphotography.com/cmsAdmin/admin.php?redirectUrl=" . $_SERVER['REQUEST_URI']);
    exit;
  }


So the getCurrentUserFromCMS function returns an array that looks similar to the $CURRENT_USER array, but contains the CMS users information. 

Thanks!

Greg

I'm not using website membership on these sites

I'll keep that in mind though.

Jerry Kornbluth

If you use version 2.53, you must check that the variable $GLOBALS [“WSM_SEPARATE_LOGIN”] is on "false" (in websiteMembership).

<?php
  if (!defined('START_SESSION')) { define('START_SESSION', true); }
  require_once "/path_to_your/cmsAdmin/lib/viewer_functions.php";
  if (!isset($CURRENT_USER['username'])) { header("Location: /"); exit; }
?>

Hope that helps!

Djulia

Any new insights on this?

Jerry Kornbluth

Sorry, but That didn't change anything. the result is identical.

I thought $CURRENT_USER was only valid when using the membership plugin. I guess not.

Jerry

Are you still having issues with the page redirecting on some browsers?

I hadn't noticed earlier, but CMS Builder empties out the $_SESSION array and stores all user data in $CURRENT_USER for security reasons. So to detect if a user is logged in or not I would do this:

   if (!defined('START_SESSION')) { define('START_SESSION', true); }
  // load viewer library
  $libraryPath = 'cmsAdmin/lib/viewer_functions.php';
  $dirsToCheck = array('/hsphere/local/home/a887307/elleschorrphotography.com/','','../','../../','../../../');
  foreach ($dirsToCheck as $dir) { if (@include_once("$dir$libraryPath")) { break; }}
  if (!function_exists('getRecords')) { die("Couldn't load viewer library, check filepath in sourcecode."); }
  if (!@$CURRENT_USER['num']){ 
    redirectBrowserToUrl("http://elleschorrphotography.com/cmsAdmin/admin.php?redirectUrl=" . $_SERVER['REQUEST_URI']);
    exit;
  }

So as the $CURRENT_USER['num'] is a field that can't be changed, I've used it to detect if a user is logged in or not. 

Thanks!

Greg

With the code you recommended (below) I get the same error.

The protected page is http://elleschorrphotography.com/publicity.php

If I'm lot logged in, the URL is http://elleschorrphotography.com/cmsAdmin/admin.php?redirectUrl=/publicity.php and I get redirected to the login page.

The URL that comes up after login is still http://elleschorrphotography.com/cmsAdmin/admin.php?redirectUrl=/publicity.php but I get the same error as before.

I've tried a few sites with the same result.

Jerry

<?php
 
 if (!defined('START_SESSION')) { define('START_SESSION', true); }
  // load viewer library
  $libraryPath = 'cmsAdmin/lib/viewer_functions.php';
  $dirsToCheck = array('/hsphere/local/home/a887307/elleschorrphotography.com/','','../','../../','../../../');
  foreach ($dirsToCheck as $dir) { if (@include_once("$dir$libraryPath")) { break; }}
  if (!function_exists('getRecords')) { die("Couldn't load viewer library, check filepath in sourcecode."); }
  if (!@$_SESSION['username']) {
    redirectBrowserToUrl("http://elleschorrphotography.com/cmsAdmin/admin.php?redirectUrl=" . $_SERVER['REQUEST_URI']);
    exit; }
?>

The most likely cause is that the page has already sent the headers in the newer version CMSB for some reason, and so can't change the header to send the page to a new location.

Try changing your code to this:

<?php
  if (!defined('START_SESSION')) { define('START_SESSION', true); }
  require_once "/path_to_your/cmsAdmin/lib/viewer_functions.php";
  if (!@$_SESSION['username']) { 
    redirectBrowserToUrl("http://mydomain.com/cmsAdmin/admin.php?redirectUrl=" . $_SERVER['REQUEST_URI']);
    exit; 
  }
?>

The redirectBrowerToUrl function detects if the page headers have already been sent, and uses HTML or JavaScript to redirect the browser instead if required.

Let me know if this doesn't work.

Thanks!

Greg