Question

Let’s suppose that we have poor MVC framework without modules support. Our aim is to implement admin panel with some functionality.
Url for all admin panel features will start with /admin (/admin/add_user, /admin/remove_user) etc.
As we don’t have modules, so we have to create Admin controller (yes, this controller probably will be extra large).

<?
class AdminController extends Controller {

    public function addUser() {
        ...
    }

    public function removeUser() {
        ...
    }

}
?>

How can we protect this methods of being accessed by anyone? .htaccessing /admin folder is not a good idea, I think.

Thank you.

Answer 1

Make all functions private and implement a public function __call which checks whether the user is logged in and has appropriate rights and then either throws an error message or redirects to the correct method.