Wsrtjtyk

I have Controller called login.php that will take login credentials, if true user will be directed to a method profile() in another controller called page.php.
In that profile() method only contain a command to load the view of user's profile.


So the route is like this:

Home->login->profie

But when I try to bypass the login process via url like this

Home->profile

The system still accept that. How can I make a rule that a user can't open profile if they're not logged in?

Here's the Controller:

page.php

class page extends CI_Controller {



    function __construct() {

        parent::__construct();

        $this->load->model('User_model', 'user_model', TRUE);

        $this->load->library('form_validation');    

        $this->form_validation->set_error_delimiters('<div class="error">', '</div>');

        $this->status = $this->config->item('status'); 

        $this->roles = $this->config->item('roles');

    }



    function index() {

        $this->load->view('page_header');

        $this->load->view('content_front');

        $this->load->view('page_footer');

    }





    function login() {

        $this->load->view('page_header');

        $this->load->view('content_login');

        $this->load->view('page_footer');

    }



    function register() {



       $this->load->view('page_header');

       $this->load->view('content_register');

       $this->load->view('page_footer');



   }  





    function profile(){



        $this->load->view('page_header');

        $this->load->view('content_profile');

        $this->load->view('page_footer');



    }



    function success() {

        $this->load->view('page_header');

        $this->load->view('content_success');

        $this->load->view('page_footer');

    }



    function logout()

    {

            //destroy session

        $data = array('login' => '', 'uname' => '', 'uid' => '');

        $this->session->unset_userdata($data);

        $this->session->sess_destroy();



        redirect('page/index');

    }





}





?>

login.php

<?php



class Login extends CI_Controller

{

    public function __construct()

    {

        parent::__construct();

        $this->load->helper(array('form','url','html','security'));

        $this->load->library(array('session','form_validation'));

        $this->load->database();

        $this->load->model('user_model');

    }



    function index()

    {

        //get form input

        $username = $this->input->post('username');

        $password = $this->input->post('password');



        //form validation

        $this->form_validation->set_rules('username','username','trim|required|xss_clean');

        $this->form_validation->set_rules('password','Password','trim|required|xss_clean');



        if($this->form_validation->run() == FALSE)

        {

            //validation fail

            $this->load->view('content_login');

        }

        else

        {

            //check user credentials

            $uresult = $this->user_model->get_user($username, $password);

            if(count($uresult)>0)

            {

                //set session

                $sess_data = array('login' => TRUE, 'uname' => $uresult[0]->username,'uid' => $uresult[0]->id);

                $this->session->set_userdata($sess_data);

                $this->load->library('../controllers/page');

                $this->page->profile();

            }

            else

            {

                $this->session->set_flashdata('msg','<div class = "alert alert-danger text-center">Wrong Email/Password</div>');

                $this->load->library('../controllers/page');

                $this->page->login();



            }

        }

    }

}



?>

Can anyone please help me how to fix this?
Thank you.

Add a constructor to every applicable controller.
Let the constructor check if the user is logged in, possibly by checking if a particular session exists. If it doesn't redirect to the login page.

Something like below

   function __construct(){

        parent::__construct();

        if(!$this->session->userdata('userid')){

            redirect('user/login');

        }

    }

use this at the top of the page you don't want it accessed when not logged in (supposing you've already set session data)

<?php if (!isset($_SESSION['username'])) {

    redirect(base_url());

} ?>

Before showing that page, you should check whether that session exist or not, like if($this->session->userdata('username')). If exists, show that page, if not show any warning.

You can try

if ($this->session->userdata('login') == true) {

   redirect('controller');

}

Login Controller

<?php



class Login extends CI_Controller

{

    public function __construct()

    {

        parent::__construct();

        $this->load->helper(array('form','url','html','security'));

        $this->load->library(array('session','form_validation'));

        $this->load->database();

        $this->load->model('user_model');

    }



    function index()

    {



     if ($this->session->userdata('login') == true) {

        redirect('controller');

      }

        //get form input

        $username = $this->input->post('username');

        $password = $this->input->post('password');



        //form validation

        $this->form_validation->set_rules('username','username','trim|required|xss_clean');

        $this->form_validation->set_rules('password','Password','trim|required|xss_clean');



        if($this->form_validation->run() == FALSE)

        {

            //validation fail

            $this->load->view('content_login');

        }

        else

        {

            //check user credentials

            $uresult = $this->user_model->get_user($username, $password);

            if(count($uresult)>0)

            {

                //set session

                $sess_data = array('login' => TRUE, 'uname' => $uresult[0]->username,'uid' => $uresult[0]->id);

                $this->session->set_userdata($sess_data);

                $this->load->library('../controllers/page');

                $this->page->profile();

            }

            else

            {

                $this->session->set_flashdata('msg','<div class = "alert alert-danger text-center">Wrong Email/Password</div>');

                $this->load->library('../controllers/page');

                $this->page->login();



            }

        }

    }

}

Couple things I noticed also in Codeigniter 3 + versions the first letter must only be upper case on FILENAME and Controller Class

Also you don't need to close the controllers and model with ?> https://www.codeigniter.com/user_guide/general/styleguide.html#php-closing-tag

If for example you don't want the user to enter a function without login, you could check the session in the constructor of the class.

If it's only for a specific function, you could just also check the session in the function directly.

Create a helper file login_helper.php

function check_login( $session ) {

     $CI =& get_instance();

     $CI->load->helper('url');

     if(!$session->userdata('login')){

         redirect(base_url());

     }



}

Now use this helper function in controllers where login is mandatory

class page extends CI_Controller {



function __construct() {

    parent::__construct();

    $this->load->model('User_model', 'user_model', TRUE);

    $this->load->library('form_validation');    

    $this->form_validation->set_error_delimiters('<div class="error">', '</div>');

    $this->status = $this->config->item('status'); 

    $this->roles = $this->config->item('roles');

}



function index() {

    $this->load->view('page_header');

    $this->load->view('content_front');

    $this->load->view('page_footer');

}





function login() {

    $this->load->view('page_header');

    $this->load->view('content_login');

    $this->load->view('page_footer');

}



function register() {



   $this->load->view('page_header');

   $this->load->view('content_register');

   $this->load->view('page_footer');



}  





function profile(){

    check_login();

    $this->load->view('page_header');

    $this->load->view('content_profile');

    $this->load->view('page_footer');



}



function success() {

    $this->load->view('page_header');

    $this->load->view('content_success');

    $this->load->view('page_footer');

}



function logout()

{

        //destroy session

    $data = array('login' => '', 'uname' => '', 'uid' => '');

    $this->session->unset_userdata($data);

    $this->session->sess_destroy();



    redirect('page/index');

}





}

?>

Note: add login_helper in autoload.php in config folder.

$autoload['helper'] = array('login','url','cookie');

if($this->session->userdata('logged_in') == FALSE) {

            $this->session->set_flashdata('error','<p class="alert alert-danger">Please login to view this page.</p>');

            redirect('login_c');

            exit;



}