Solved

These pages is for Administrators only (My Application)

Posted on 2004-08-12
5
139 Views
Last Modified: 2013-12-24
Hello,

Please help restrict my Administrator pages (about 20 pages) from the rest of the other users.

I have my Access database with a table of users that includes a field for UserLevels.

if the UserLevel is 3 and above, that user should be able to access the 20 cfm pages available only for administrators.

Please I would like to request some code and where to put it.  Please be clear as possible.  It's the end of the week again and I have to come up with the login module by tommorow afternoon.  Please, I hope you understand.

Thanks in advance.

PS.  All users of my application will have to login.  But only Administratrs have the access to the Admin pages.

By the way, i use the basic session method in Ben forta's book.  So, those CFlogout, CFlogin is a bit different from what i am doing.
0
Comment
Question by:mdbbound
5 Comments
 
LVL 11

Accepted Solution

by:
hart earned 500 total points
ID: 11791358
ok how about this when the user logs in ..
and after u authenticate him with the database values...

create a session variable session.userlevel with the appropriate value

just put a if condition on top of the 20 files...

<cfif IsDefined(Session.UserLevel) And Session.UserLevel LT 3 ><!--- Not Admin user --->
   Show him some data saying no access to this page
   </cfabort>
</cfif>

now put this code in a common file that is UserAccess.cfm
and include this file in the top of the 20 files

Regards
Hart
0
 
LVL 25

Expert Comment

by:James Rodgers
ID: 11792010
i have a similar setup but access levels are different, i put my admin only pages in a separate forlder and have in my Application.cfm in the folder
<cfset localAccesLevel=100> <!--- administrative level --->
<cfset RELLOCPATH = "./">
<cfset PARENTPATH = "../">

<cfinclude template="#RELLOCPATH#noHeaderPages/validateUser.cfm">

and in validateUser.cfm
<!--- validate user login --->
<!--- check for existance of Auth structure created during valid login --->
<cfif not isDefined("SESSION.Auth.UserID") OR not isDefined("SESSION.Auth.AccessLevel")>
      <!--- invalid login --->
      <cflocation url="#PARENTPATH#_errorPages/loginError.cfm" addtoken="No">
</cfif>

<!--- validate user level --->
<!--- compare the access level defined on the page to the user's access level --->
<cfif SESSION.Auth.AccessLevel LT localAccessLevel>
      <!--- invalid user access level error --->      
      <cflocation url="#PARENTPATH#_errorPages/levelError.cfm" addtoken="No">
</cfif>
0
 
LVL 35

Expert Comment

by:mrichmon
ID: 11794673
Or you can use a role based method and then if you are using a homegrown approach

<cfif Find("Admin", Session.UserAccess)>
  User allowed
<cfelse>
  User not an admin - cflocation them away
</cfif>
0
 

Expert Comment

by:Tony-28
ID: 13767595
Sorry I am new to ASP and would like to know how to create a session variable
0
 
LVL 35

Expert Comment

by:mrichmon
ID: 13767665
Tony-28, please do not post new questions at the end of other questions.  If you have a question, then create your own in the appropriate Topic Area (in your case use the ASP topic area NOT the cold fusion topic area)
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

In our day to day coding, how many times have we come across a necessity to check whether a URL is a broken link or not? For those of you that answered countless and are using ColdFusion like myself, then this article is for you.  It will show yo…
Periodically we have to update or add SSL certificates for customers. Depending upon your hosting plan you may be responsible for the installation and/or key generation. In the wake of Heartbleed many sites were forced to re-key. We will concen…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now