Stop USER A from being able to access USER B's profile page

[yiaggi]

Hi guys,

 

I am trying to put together a little system that allows users to log onto my website and access there own personal page. I am creating each page myself and uploading content specific to them which cannot be viewed by anyone else.

 

I have got the system to work up as far as:

 

1/ The user logs in

2/ Once logged in they are re-directed to their own page using 'theirusername.php'

 

Thats all good and working how I need it too. The problem I have is this. If I log onto the website using USER A details - I get taken to USER A's page like I should but - If I then go to my browser and type in USERBdetails.php I can then access USER B's page.

 

This cannot happen!! I need for USER A not to be able to access USER B profile - there is obviously no point in the login otherwise! If you are not logged in you obviously cannot access any secure page. That much is working!

 

Please find below the code I am using:

 

 

LOGIN

 

<?php

session_start();

 

 

function dbconnect()

{

    $link = mysql_connect("localhost", "username", "password") or die ("Error: ".mysql_error());

 

}

?>

 

<?php

if(isset($_SESSION['loggedin']))

{

    header("Location:" . strtolower($username) . ".php");

if(isset($_POST['submit']))

{

  $username = mysql_real_escape_string($_POST['username']);

  $password = mysql_real_escape_string($_POST['password']);

  $mysql = mysql_query("SELECT * FROM clients WHERE username = '{$username}' AND password = '{$password}'");

  if(mysql_num_rows($mysql) < 1)

  {

    die("Password or Username incorrect! Please <a href='login.php'>click here</a> to try again");

  }  $_SESSION['loggedin'] = "YES";

  $_SESSION['username'] = $username;

$_SESSION['name']

  header("Location:" . strtolower($username) . ".php");

}

?> 

 

HEADER ON EACH PHP PAGE

 

<?php

session_start();

if(!isset($_SESSION['loggedin']))

{

    die(Access to this page is restricted without a valid username and password);

?>

 

---------------------------------------------------

 

Am I right in thinking it is something to do with the "loggedin" part?

 

The system I have here is adapted from a normal login system I have been using for years. The original just checks the details and then does a 'session start'. This one obviously has to re-direct to a user specific page. To do this I used the <<header("Location:" . strtolower($username) . ".php");>> line to redirect to a page such as "usera.php" or "userb.php"

 

Any help would be greatly appreciated! 

 

Ta

[micah1701]

modify your security script with something like:

 

<?php
session_start();
if(!isset($_SESSION['loggedin']))
{
    die(Access to this page is restricted without a valid username and password);
}

//add this:
$url_parts = $_SERVER['PHP_SELF'];  //returns "/path/to/current/page/username.php"
$filename = array_pop('/',$url_parts);  //returns "username.php"
if ($_SESSION['username'].".php" != $filename){
  die("You are not allowed to view another user's page");
}

?>

[yiaggi]

Thanks mate. That has done the trick

 

Whilst I have you - I dont suppose you know how to create an admin page with a file upload area?

 

I basically want the secretarys to be able to log in and upload PDF's that are specific to each user via a simple form. Once uploaded the PDF will then have to appear as a download link on the users page.

 

Any idea's?

 

Cheers for your help