Question

我有2个页面：admin.php和admin_index.php。我在admin.php中有一个用户名和密码字段，我使用数据库进行身份验证。如果用户已通过身份验证，则会加载admin_index.php。我使用dreamweaver cs5将限制访问页面服务器行为添加到admin_index.php页面。但是如果我尝试使用url直接访问admin_index.php页面，我仍然可以。这两个页面的会话代码都在所有其他内容之上，它是：

<?php 
if (!isset($_SESSION)) {
session_name("ckfinder");   
session_start();
$_SESSION['site'] = "wildgameservices"; 
} 
?>

任何人都可以指出我的错误吗？

编辑：我在每次测试页面之前都清除了cookie。

编辑：Dreamweaver添加的自定义代码，用于身份验证：

<?php
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";

// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 
// For security, start by assuming the visitor is NOT authorized. 
$isValid = False; 

// When a visitor has logged into this site, the Session variable MM_Username set      
equal to their username. 
// Therefore, we know that a user is NOT logged in if that Session variable is blank. 
if (!empty($UserName)) { 
// Besides being logged in, you may restrict access to only certain users based on an 
ID established when they login. 
// Parse the strings into arrays. 
$arrUsers = Explode(",", $strUsers); 
$arrGroups = Explode(",", $strGroups); 
if (in_array($UserName, $arrUsers)) { 
  $isValid = true; 
} 
// Or, you may restrict access to only certain users based on their username. 
if (in_array($UserGroup, $arrGroups)) { 
  $isValid = true; 
} 
if (($strUsers == "") && true) { 
  $isValid = true; 
} 
} 
return $isValid; 
}

$MM_restrictGoTo = "admin.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers,     

$_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {   
$MM_qsChar = "?";
$MM_referrer = $_SERVER['PHP_SELF'];
if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0) 
$MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
$MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" .    

urlencode($MM_referrer);
header("Location: ". $MM_restrictGoTo); 
exit;
}

Answer 1

您是否需要执行if语句并检查有效会话？这样的事可能

if($_SESSION['site'] != "wildgameservices"){
  return;
  // or exit(); not sure what you want
}

无法在php5中限制对页面的访问

1 个答案: