Quick Authentication

It should have an empty array in there, but maybe it doesn't. We may not be storing it.

Brian - Personal Blog

-- moved --

Is there anyway to get this to report the group_id? I am trying to configure a portion of my site that requires the user to be in a specific group to access.

http://www.krang.org

no, you would need to get the whole user to get the group_ids where he is in.
The simple-auth script just gets the columns in the user-table.

---

Thomas Seifert

new version with an additional check for user_data being an array as this field could be empty in 5.1.

---

Thomas Seifert

Here's a slightly different take on that code. I wanted a "fire and forget" type solution, the ability to check group membership, and (at least on my system) the original code didn't work for short term cookies (and also didn't check if they were valid).


So I went through and gutted/re-wrote some stuff, and wrapped what was left in functions. Written/tested against 5.1.10; other versions YMMV.





usage:

(edit new_quick_auth.php and set which cookie type you want to use (long or short), and where your config.php file for phorum is located first!)

require_once ("new_quick_auth.php");

(gets my code in your code)

phorum_my_check_session();

(checks to see if user has valid cookies of either type. returns user_id if
user is logged in, FALSE if not.)

phorum_my_check_group(group_id);

(checks to see if user is allowed access to group_id. returns TRUE if user
user allowed, FALSE if not or not logged in.)






examples:


$user_id = phorum_my_check_session(); // check to see if user is logged in
if ($user_id)
echo "user_id of logged in user: " . $user_id . "<br>\n";
else
echo "user not logged in!<br>\n";



$groupcheck = phorum_my_check_group(1); // check to see if user is allowed access to group 1
if ($groupcheck)
echo "user allowed access to group 1.<br>\n";
else
echo "user not allowed access to group 1 (or group doesn't exist).<br>\n";



$groupcheck = phorum_my_check_group(1000); // check to see if user is allowed access to group 1000
if ($groupcheck)
echo "user allowed access to group 1000.<br>\n";
else
echo "user not allowed access to group 1000 (or group doesn't exist).<br>\n";



You don't need to check the session first then check the group; checking a group is invalid without a good session, so you can simply call that function if you're so inclined.

Hi TheKorn,

thank you seems to be a useful improvement I'll try out the code.

short term cookies are not for main-authentication, they are for write auth if tight security is enabled.

---

Thomas Seifert

Quote
ts77
short term cookies are not for main-authentication, they are for write auth if tight security is enabled.

Ahhh, oops! Obviously shouldn't use the short term cookie auth check then. :)

Hibrianlmoon,

A very usefull small piece of code :-)

It works good, but something strange in the source of "quick_auth.php (5.1)" :

$user = urldecode($user);

if(get_magic_quotes_gpc()){
$user=stripslashes($user);
$md5pass=stripslashes($md5pass);
}

The problem is that $user and $md5pass are not created/present in this code
and then generate 2 "PHP Notice" at each page :-(

It seems to me as unused code of a previous version
and then should (maybe?) be removed in (5.1)

Regards
Oukiva