0

I would like to detect if the user has an active admin session via an external script. I have the below code but the security issue with this is that someone could simply copy the cookie from one PC to another and it will still evaluate. Can anyone suggest another way of doing this

include('app/Mage.php');
Mage::app()->setCurrentStore(Mage_Core_Model_App::ADMIN_STORE_ID);
error_reporting(E_ALL | E_STRICT);
Mage::setIsDeveloperMode(true);
ini_set('display_errors', 1);
ob_implicit_flush (1);

$sesId = isset($_COOKIE['adminhtml']) ? $_COOKIE['adminhtml'] : false ;
$session = false;
if($sesId){
    $session = Mage::getSingleton('core/resource_session')->read($sesId);
}
$loggedIn = false;

if($session)
{
    if(stristr($session,'Mage_Admin_Model_User'))
    {
        $loggedIn = true;
    }
}
var_dump($loggedIn);
1

Yes ,you can achieve this by making a file in root of magento like test.php and put this code

require_once('app/Mage.php');
umask(0);
Mage::app();
 Mage::getSingleton('core/session', array('name'=>'adminhtml'));
if(Mage::getSingleton('admin/session')->isLoggedIn()){
  echo "welcome sweet boy";
}
else
{
  echo "You Are Cheater";
}
  • Unfortunately that didnt work but I have now updated the question – Goose84 May 14 '15 at 12:13
0

Why don't you just check for admin sessions?

//get the admin session
Mage::getSingleton('core/session', array('name'=>'adminhtml'));

//verify if the user is logged in to the backend
if(Mage::getSingleton('admin/session')->isLoggedIn()){
   //do stuff
}
else
{
  echo "go away bad boy";
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.