02.06.2013 Views

Pro PHP and jQuery by Jason Lengstorf.pdf - Computer Science ...

Pro PHP and jQuery by Jason Lengstorf.pdf - Computer Science ...

Pro PHP and jQuery by Jason Lengstorf.pdf - Computer Science ...

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

228<br />

CHAPTER 6 ■ PASSWORD PROTECTION SENSITIVE ACTIONS AND AREAS<br />

}<br />

?><br />

}<br />

}<br />

After inserting these changes, navigate to http://localhost/ while logged out <strong>and</strong> click an event to<br />

bring up its full view; the administrative options will not be displayed (see Figure 6-10).<br />

Figure 6-10. The full event view while logged out<br />

Limiting Access to Administrative Pages<br />

As an additional security precaution, you should ensure that any pages that only authorized users should<br />

have access to, such as the event creation/editing form, check for proper authorization before executing.<br />

Disallowing Access to the Event Creation Form Without Login<br />

You can prevent a mischievous user from finding the event creation form while logged out <strong>by</strong><br />

performing a simple check that you add to the file. If the user is not logged in, he’ll be sent to the main<br />

calendar view before the script has the chance to execute.<br />

To implement this change, open admin.php <strong>and</strong> insert the code shown in bold:<br />

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!