1

我有 2 页：admin.php 和 admin_index.php。我在 admin.php 中有一个用户名和密码字段，我使用数据库对其进行身份验证。如果用户通过身份验证，则加载 admin_index.php。我使用 dreamweaver cs5 将限制访问页面服务器行为添加到 admin_index.php 页面。但是，如果我尝试使用 url 直接访问 admin_index.php 页面，我仍然可以。两个页面的会话代码都位于所有其他内容之上，它是：

<?php 
if (!isset($_SESSION)) {
session_name("ckfinder");   
session_start();
$_SESSION['site'] = "wildgameservices"; 
} 
?>

谁能指出我的错误？

编辑：我在每次测试页面之前都清除了 cookie。

编辑：dreamweaver 添加的用于身份验证的自定义代码：

<?php
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";

// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 
// For security, start by assuming the visitor is NOT authorized. 
$isValid = False; 

// When a visitor has logged into this site, the Session variable MM_Username set      
equal to their username. 
// Therefore, we know that a user is NOT logged in if that Session variable is blank. 
if (!empty($UserName)) { 
// Besides being logged in, you may restrict access to only certain users based on an 
ID established when they login. 
// Parse the strings into arrays. 
$arrUsers = Explode(",", $strUsers); 
$arrGroups = Explode(",", $strGroups); 
if (in_array($UserName, $arrUsers)) { 
  $isValid = true; 
} 
// Or, you may restrict access to only certain users based on their username. 
if (in_array($UserGroup, $arrGroups)) { 
  $isValid = true; 
} 
if (($strUsers == "") && true) { 
  $isValid = true; 
} 
} 
return $isValid; 
}

$MM_restrictGoTo = "admin.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers,     

$_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {   
$MM_qsChar = "?";
$MM_referrer = $_SERVER['PHP_SELF'];
if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0) 
$MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
$MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" .    

urlencode($MM_referrer);
header("Location: ". $MM_restrictGoTo); 
exit;
}
4

1 回答 1

0

您不需要执行 if 语句并检查有效会话吗？像这样的东西也许

if($_SESSION['site'] != "wildgameservices"){
  return;
  // or exit(); not sure what you want
}
于 2011-07-05T17:02:23.993 回答