2

I'm using Magento 1.9.

I have created a module and added a page in the backend that can be accessed by the menu. This page contains an iframe (declared in a phtml file) which loads an own application. The php files of this application are on the same server.

Everything works fine so far. However, I have a security issue. The application in the iframe could be accessed by calling the php script directly if the URL is known. And this shouldn't be possible.

Now I think the best what I could do is to check if the caller of the script is a logged in backend user. Right? But I'm not sure how to do this.

I have done the following in the phtml file:

<iframe src="/path/to/app.php" frameborder="0" width="100%" height="1000px"></iframe>

And in app.php:

require_once('../../app/Mage.php'); 
Mage::app();
$session = Mage::getSingleton('admin/session');
$session->isLoggedIn();

But isLoggedIn always returns false. What do I have to do to make it work correctly? As a newbie I don't have any clue.

3

I have created the following solution which seems to work with Magento 1.9 (at least it works for me). This solution can be also found elsewhere in the net. But I rewrote it since those other listings didn't work for me.

require_once('../app/Mage.php');

function isBackendUserLoggedIn() {
    if (!array_key_exists('adminhtml', $_COOKIE)) return false;

    if(!session_id()) session_start();
    $oldSession = $_SESSION;

    Mage::app();

    $sessionFilePath = Mage::getBaseDir('session') . DS . 'sess_' . $_COOKIE['adminhtml'];
    $sessionContent  = file_get_contents($sessionFilePath);

    session_decode($sessionContent);

    /** @var Mage_Admin_Model_Session $session */
    $session  = Mage::getSingleton('admin/session');
    $loggedIn = $session->isLoggedIn();

    //set old session back to current session
    $_SESSION = $oldSession;

    return $loggedIn;
}

if(isBackendUserLoggedIn()) {
    echo 'Welcome!';
} else {
    echo 'Go away!';
}

I hope this solution is acceptable concerning security and stability. Please let me know if it could get improved or if there are any other better aproaches.

  • Please mark it as solution, great you fixed it! – Fabian Blechschmidt Sep 1 '14 at 21:12
  • Done that. It's the accepted solution which might not be the best though... – robsch Sep 2 '14 at 8:31
  • You decide what to accept, we decide (through voting) which is the best :-) – Fabian Blechschmidt Sep 2 '14 at 15:27
2

Your problem is, that the backend and the frontend session has two different names.

When your application uses session_name('admin'), then it can access the backend session and make sure, the user is logged in.

Mage::app() runs per default in frontend, therefore you can't access the admin session. A hacky solution can be found here: https://stackoverflow.com/a/16034942/1480397

You can try with:

Mage::app('admin')

then the session might be read automatically.

  • Hm... not sure what I should do (besides learning Magento development). Is there no sound solution for this problem? – robsch Aug 27 '14 at 15:45
  • 1
    Nope, for security reasons, the sessions are split. What you can do is implement your own session handling, because you can both read the session cookie and open the session and read the session content. – Fabian Blechschmidt Aug 27 '14 at 16:07
  • Sorry to bother again... Did you get my request right? I assume so but just would like to make sure. You were writing about frontend in conjunction with backend. My issue was about backend only. The iframe is in the backend and the application within won't be accessed by frontend navigation. Does this change things? – robsch Aug 29 '14 at 7:05
  • Thanks for pointing out. My thoughts are sometimes a little bit weird and I think faster than I type, so things get lost. Of course this changes things. What you want to do is to init the admin store for usage. I edited the answer, this should work – Fabian Blechschmidt Aug 29 '14 at 7:18
  • Thanks. But there must be something else. isLoggedIn is always false if I just replace Mage::app() with Mage::app('admin'). I've tried it also with 'default' and Mage::getSingleton('core/session', array('name'=>'adminhtml')) in different combinations. A single time I could see that isLoggedIn was true but I cannot reproduce this anymore. Could you make a complete example? I guess it's not so complicated. But I cannot figure it out by myself. – robsch Aug 29 '14 at 12:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.