I would like to detect if the user has an active admin session via an external script. I have the below code but the security issue with this is that someone could simply copy the cookie from one PC to another and it will still evaluate. Can anyone suggest another way of doing this
include('app/Mage.php');
Mage::app()->setCurrentStore(Mage_Core_Model_App::ADMIN_STORE_ID);
error_reporting(E_ALL | E_STRICT);
Mage::setIsDeveloperMode(true);
ini_set('display_errors', 1);
ob_implicit_flush (1);
$sesId = isset($_COOKIE['adminhtml']) ? $_COOKIE['adminhtml'] : false ;
$session = false;
if($sesId){
$session = Mage::getSingleton('core/resource_session')->read($sesId);
}
$loggedIn = false;
if($session)
{
if(stristr($session,'Mage_Admin_Model_User'))
{
$loggedIn = true;
}
}
var_dump($loggedIn);