登錄/註銷的管理員和普通用戶

Question

我做了一個登錄/註銷頁面，但現在我我會喜歡，因爲他們登錄到管理，從普通用戶分開。我所試圖做的是有普通用戶只是查看可用的文件和管理員很好，當然，他們將能夠查看和編輯這些文件。

現在我的設立：

登錄 .PHP

<?php 
session_start(); 
include("password.php"); 
require_once "config.php"; 

/* Constants */ 
$TITLE = "Formation - User Login"; 
$CSS = array("assets/css/formation.css"); 
$JAVASCRIPT = array(); 
$mode = $_GET["mode"]; 
/* Template */ 

require_once $TEMPLATE_PATH."header.php"; 

if ($mode == "login") { /// do after login form is submitted 
    if ($USERS[$_POST["username"]]==$_POST["password"]) { /// check if submitted username and password exist in $USERS array 
      $_SESSION["login"]=$_POST["username"]; 
      header("location:index.php"); 
    } else { 
      echo "Incorrect username/password. Please, try again."; 
    }; 
} else if ($mode == "logout") { 
     session_start(); 
     unset($_SESSION["login"],$USERS); 
     header("location: login.php"); 
     exit(0); 
}; 
echo <<< XHTML 

    <h1>$TITLE</h1> 
    <form id="form" method="post" action="{$LOGIN_URL}?mode=login"> 
     <label id="username_label" for="username" class="normal">Username</label> :<br /> 
     <input id="username" name="username" type="text" value="" class="half" /><br /> 
     <label id="password_label" for="password" class="normal">Password</label> :<br /> 
     <input id="password" name="password" type="password" value="" class="half" /><br /> 
     <input id="submits" type="submit" value="Login" /> 
    </form> 

XHTML; 

require_once $TEMPLATE_PATH . "footer.php"; 

?> 

密碼 .PHP（驗證用戶名和密碼）

<?php 
$USERS["drodrig1"] = "pwd1"; 
$USERS["jsutta"] = "pwd2"; 
$USERS["username3"] = "pwd3"; 

function check_logged(){ 
    global $_SESSION, $USERS; 
    if (!array_key_exists($_SESSION["login"],$USERS)) { 
      header("Location: login.php"); 
      exit(0); 
    }; 
}; 
?> 

配置 .PHP

<?php 

$ASSETS_URL = "https://url-link/formationXX/assets/"; 
$ASSETS_PATH = "serverpath/formationXX/assets/"; 
$TEMPLATE_URL = "https://url-link/formationXX/assets/template/"; 
$TEMPLATE_PATH = "serverpath/formationXX/assets/template/"; 
$LOGIN_URL = "https://url-link/formationXX/login.php"; 
$LOGIN_PATH = "serverpath/formationXX/login.php"; 

?> 

索引 .php（登錄後，這是我想看到管理員區別於普通用戶的地方。管理員應該可以查看和編輯以下內容：CSS，JS，電子郵件，PDF和電子表格。同時用戶可以只能查看所有除：CSS，JS）

<?php 

require_once "config.php"; 
session_start(); /// initialize session 
include("password.php"); 
check_logged(); /// function checks if visitor is logged. 

/* Constants */ 
$TITLE = "Formation - User Login"; 
$CSS = array("assets/css/formation.css"); 
$JAVASCRIPT = array(); 
/* Template */ 

require_once $TEMPLATE_PATH."header.php"; 

echo <<< XHTML 
     <form id="form" method="post" action="{$LOGIN_URL}?mode=login"> 
      <div class="full row column"> 
      <h1>{$TITLE}</h1> 
      </div> 
      <div class="full row column"> 
      <div class="half column small"> 
       <p>Logged in as: <strong>{$_SESSION["login"]}</strong> | <a href="{$LOGIN_URL}?mode=logout" class="small">Logout</a></p><br /> 
       Add Form | Delete Selected Form(s) 
      </div> 
      </div> 
      <div class="full row column"> 
      <table id="formslist" cellpadding="0" cellspacing="0"> 
       <th> 
       <tr> 
        <td class="form_select"> 
        <input id="selectallforms" name="selectallforms" type="checkbox" value="Select All Forms" /> 
        </td> 
        <td class="form_id"> 
        ID 
        </td> 
        <td class="form_url"> 
        URL 
        </td> 
        <td class="form_dates"> 
        Launch Date 
        </td> 
        <td class="form_dates"> 
        Expiration Date 
        </td> 
        <td class="form_autofill"> 
        Autofill 
        </td> 
        <td class="form_save"> 
        **CSS** 
        </td> 
        <td class="form_save"> 
        **JS** 
        </td> 
        <td class="form_save"> 
        Email 
        </td> 
        <td class="form_save"> 
        PDF 
        </td>     
        <td class="form_dates"> 
        Spread sheet 
        </td> 
       </tr> 
       </th> 
      </table> 
      </div> 
     </form> 
XHTML; 

require_once $TEMPLATE_PATH . "footer.php"; 

?> 

Answer 1

如果是在嘗試登錄用戶編輯東西，你應該檢查是否該用戶具有足夠的權限這樣做。

例如，這裏是你的用戶：

$USERS["drodrig1"]['passw'] = "pwd1"; 
$USERS["jsutta"]['passw'] = "pwd2"; 
$USERS["username3"]['passw'] = "pwd3"; 

$USERS["drodrig1"]['level'] = 0; 
$USERS["jsutta"]['level'] = 1; 
$USERS["username3"]['level'] = 0; 

這裏是我們如何檢查用戶是否可以或不可以做一些事情：

if ($_GET['action'] === 'edit' && $USERS[$_SESSION["login"]]['level'] === 1) { 
    // Go to function where users changes gets saved to files or db: 
    saveChanges($_POST); 
} else { 
    die("<h1>Sorry, you cant do that!</h1>"); 
} 

順便說一句，有很多問題，你代碼，但仍然適合學習PHP。