[eluser]qpixo[/eluser]
I have some issue with Auth Ion, the authentication works fine, I can login the user dashboard. Then I logout, it redirects back to login form which is fine. But when I enter URL and go back to dashboard auth, I can reach it which raise concern aver user security. Noticed the logout of Ion Auth, it can't delete session username...
What I want to do is once the user has logout, he can't go back to the dashboard again and display error msg. How can I implement a check user login on each page of user dashboard once he can successful log in?
Here's my code, I have create a base controller then extend it:
Code:
require APPPATH . "third_party/MX/Controller.php";
class Members_Controller extends MX_Controller {
// Defined a global user to all View
protected $user;
// Constructor
public function __construct() {
parent::__construct();
self::checkMember();
}
public function checkMember() {
// Check if user is members
if($this->ion_auth->in_group('members')) {
$data->user = $this->ion_auth->user()->row();
$this->user = $data->user;
// Load user to every Views
$this->load->vars($data);
} else {
redirect($this->config->item('base_url'));
}
}
Then in Dashboard controller I extend the base controller, I tried to add a check logged_in but it's still doesn't work
Code:
class Dashboard extends Members_Controller {
public function __construct() {
parent::__construct();
}
public function index() {
if($this->ion_auth->logged_in()) {
echo "Hello " . $this->user->username . "!";
$this->load->view('members_dashboard');
} else {
echo "You don't have access to this page...";
die;
}
}
}
Auth uses to check and validate login form:
Code:
public function index() {
// If user is not log in
if(!$this->ion_auth->logged_in()) {
// Redirect to login form
redirect('auth/login');
}
}
public function login() {
// Validated login form
$this->form_validation->set_rules('username', 'Username', 'required');
$this->form_validation->set_rules('password', 'Password', 'required');
// If it can log in
if ($this->form_validation->run() === true) {
// Get user input form
$username = $this->input->post('username');
$password = $this->input->post('password');
// Check user login compare it with model DB
if ($this->ion_auth->login($username, $password)) {
// Get the current user group
$usergroup = $this->ion_auth->get_users_groups()->row()->name;
//print_r($usergroup);
// Redirect user to proper dashboard
redirect($usergroup . '/dashboard');
// Create the user authorized in session
$this->session->set_flashdata('authorized', true);
} else {
...
redirect('auth/login');
}
} else {
// Store username in session
$username_session = $this->session->flashdata('username');
// Set username, password and submit forms
$data['username'] = array( 'name' => 'username',
'type' => 'text',
'value' => set_value('username', $username_session) );
$data['password'] = array( 'name' => 'password',
'type' => 'password' );
$data['submit'] = array ( 'type' => 'submit',
'value' => 'Login' );
$data['message'] = (validation_errors()) ? validation_errors() : $this->session->flashdata('message');
// Display login page
$this->load->view('login', $data);
}
}
