I'm using Magento 1.9.
I have created a module and added a page in the backend that can be accessed by the menu. This page contains an iframe (declared in a phtml file) which loads an own application. The php files of this application are on the same server.
Everything works fine so far. However, I have a security issue. The application in the iframe could be accessed by calling the php script directly if the URL is known. And this shouldn't be possible.
Now I think the best what I could do is to check if the caller of the script is a logged in backend user. Right? But I'm not sure how to do this.
I have done the following in the phtml file:
<iframe src="/path/to/app.php" frameborder="0" width="100%" height="1000px"></iframe>
And in app.php:
require_once('../../app/Mage.php'); Mage::app(); $session = Mage::getSingleton('admin/session'); $session->isLoggedIn();
isLoggedIn always returns false. What do I have to do to make it work correctly? As a newbie I don't have any clue.