iframe in backend: check if backend user is logged in

Question

I'm using Magento 1.9.

I have created a module and added a page in the backend that can be accessed by the menu. This page contains an iframe (declared in a phtml file) which loads an own application. The php files of this application are on the same server.

Everything works fine so far. However, I have a security issue. The application in the iframe could be accessed by calling the php script directly if the URL is known. And this shouldn't be possible.

Now I think the best what I could do is to check if the caller of the script is a logged in backend user. Right? But I'm not sure how to do this.

I have done the following in the phtml file:

<iframe src="/path/to/app.php" frameborder="0" width="100%" height="1000px"></iframe>

And in app.php:

require_once('../../app/Mage.php'); 
Mage::app();
$session = Mage::getSingleton('admin/session');
$session->isLoggedIn();

But isLoggedIn always returns false. What do I have to do to make it work correctly? As a newbie I don't have any clue.

Answer 1

I have created the following solution which seems to work with Magento 1.9 (at least it works for me). This solution can be also found elsewhere in the net. But I rewrote it since those other listings didn't work for me.

require_once('../app/Mage.php');

function isBackendUserLoggedIn() {
    if (!array_key_exists('adminhtml', $_COOKIE)) return false;

    if(!session_id()) session_start();
    $oldSession = $_SESSION;

    Mage::app();

    $sessionFilePath = Mage::getBaseDir('session') . DS . 'sess_' . $_COOKIE['adminhtml'];
    $sessionContent  = file_get_contents($sessionFilePath);

    session_decode($sessionContent);

    /** @var Mage_Admin_Model_Session $session */
    $session  = Mage::getSingleton('admin/session');
    $loggedIn = $session->isLoggedIn();

    //set old session back to current session
    $_SESSION = $oldSession;

    return $loggedIn;
}

if(isBackendUserLoggedIn()) {
    echo 'Welcome!';
} else {
    echo 'Go away!';
}

I hope this solution is acceptable concerning security and stability. Please let me know if it could get improved or if there are any other better aproaches.

Answer 2

Your problem is, that the backend and the frontend session has two different names.

When your application uses session_name('admin'), then it can access the backend session and make sure, the user is logged in.

Mage::app() runs per default in frontend, therefore you can't access the admin session. A hacky solution can be found here: https://stackoverflow.com/a/16034942/1480397

You can try with:

Mage::app('admin')

then the session might be read automatically.