How do I make certain frontend pages accessible only by admin?

Question

How do I make certain frontend pages accessible only by admin? I have tried using Mage::getSingleton('core/session') and Mage::getSingleton('admin/session') to no good end. Any suggestions?

Oh, and by pages I mean frontend controller actions in case that wasn't clear.

Answer 1

I would suggest observing controller action predispatch events like this:

<events>
    <controller_action_predispatch>
        <observers>
            <yourgropupname_yourmodulename>
                <class>yourmodulename/observer</class>
                <method>myPredispatchObserver</method>
            </yourgropupname_yourmodulename>
        </observers>
    </controller_action_predispatch>
</events>

It will fire on every controller action call.

Then inside of myPredispatchObserver method you can check if current controller is one from those you want to restrict to admin user. You can get current controller name like this:

Mage::app()->getRequest()->getControllerName();

Finally you can check if current session belongs to admin. You can try any of the following methods:

Mage::getSingleton('admin/session', array('name'=>'adminhtml'))->isLoggedIn());

// or

Mage::getSingleton('admin/session')->getUser();

// or

Mage::getSingleton('admin/session')->getUser();

Finally if user is not an admin redirect him to the referring page.

Answer 2

I'm sorry but magento still splits admin and customer session. Therefore you don't know in the frontend whether some user is admin and logged in.

Magento sets two cookies, one namened frontend and one named adminhtml. If magento initializes PHP's cookie support with session_name frontend, you get the customer's data, if magento uses adminhtml, you load the admin data.

What you can do is write an admin controller and get the data via AJAX, but then they still are submitted from admin.