Question

I am creating a function to protect my admin pages if a user is not logged in. Am I doing it in a correct way. The following function is included on all my admin pages.

What else should I check for before give acccess to my admin pages for a secure page??

    function is_logged_in_admin()
    {
    $CI =& get_instance();
    $is_logged_in = $CI->session->userdata('is_logged_in');
    $username = $CI->session->userdata('username');
    $status = $CI->session->userdata('status');
       if(!isset($is_logged_in) || $is_logged_in != true)
       {
       redirect('auth/login',location);
       } 

    if(!$username == 'myeswr')
       {
       redirect('auth/login',location);
       } 

    if(!$status == '1')
       {
       redirect('auth/resend_activation',location);
       } 
}

Answer 1

With the code you have here, there is a possibility for granting permission w/o intent. Its not likely, but if for some reason there is a logic error (not syntax error) somewhere in your code for if #1, you are not redirected, and the other 2 fail.

I suggest using if.. elseif.. elseif.. else. Final else being a redirect to login, as a failsafe.

You may also want to check length of login (or just use CI’s built in session length).