Authentication problem

Client Joined: Oct 07, 2003 Posts: 735 Location: Ohio

I have a page that verifys if a user has permission to access some pages on my site. I use NSNGroups to check if they belong to the correct group, then I check thier username and see if it matches a username in the team. If both checks are True then they are redirect to the proper page.

Code:

if (!defined('MODULE_FILE')) { 


    die ("You can't access this file directly..."); 


} 





require_once("mainfile.php"); 


$module_name = basename(dirname(__FILE__)); 


global $prefix, $db; 





if (!in_groups('2-3')) { 


   // Not authorized 


    Redirect to access denied...Sentinal was blocking this code


   echo "<a href=\"modules.php?name=Campaign&file=AccessDenied\">"; 


} 





$nukeusername = $userinfo['username'];  





$sql = "SELECT team_id FROM " . $prefix . "_tc_userteams WHERE (name='$nukeusername')"; 


   $result = $db->sql_query($sql); 


   while ( $row = $db->sql_fetchrow($result) ) {


         $team_id = $row['team_id'];


   }


   if ($db->sql_numrows($result) > 0) { 


       @session_destroy(); 


       session_start(); 


       $_SESSION['loggedin1'] = 1;       


       //Header("Location: modules.php?name=Campaign&file=Orders&amp;team_id=$team_id"); 


      Header("Location: modules.php?name=Campaign&file=Orders&team_id=$team_id");


    } else { 


       @session_destroy(); 


       session_start(); 


       $_SESSION['loggedin1'] = 0;       


       Header("Location: modules.php?name=Campaign&file=AccessDenied"); 


    } 


    die(); 





?>

A few people get the Access Denied, but they do belong to the correct groups and also belong to a team. I am scratching my head on this.

The beginning of my Orders.php page looks like this:

Code:

<?php


session_start();


if(!session_is_registered(loggedin1)){


Header("Location: modules.php?name=Campaign&file=checkcommander"); 


}

Anybody have any ideas. So far two people out of maybe 15 who have tried get Access Denied yet they all have the same access conditions.

registered · Posted: Fri Dec 15, 2006 1:31 pm

I'm not sure how NSN Groups work

But on your Orders.php

Code:




if(!session_is_registered(loggedin1)){

Is loggedin1 meant as a string? Or a variable?

Posted: Fri Dec 15, 2006 1:42 pm

Isn't it the value of $_SESSION ?

as in $_SESSION['loggedin1'] = 1;

Posted: Sat Dec 16, 2006 11:58 am

Disregard this. I think it was an issue of him clicking the link in the post versus clicking the link in the block.