Login / Logout

[alex4orly]

Following up on several postings on the topic, I am still not seeing a resolution.
So I created two php pages - please see this url : http://www.nmaa-rc.org.au/entry.php

1) an entry page : entry.php, it has on it a Page protect object and the password is 12345
2) If successful, it has a redirection to a page called target.php
3) The target.php page has an image and a Logout object - the php code generated is the following code, clearly showing that I want it to go to the Page protect password object, instead - it goes back into the target.php page instead of logging out...

Pablo, this has no DBTS CSV List extension - it is all WWB code without any manual intervention

So, please tell me, what am I doing wrong here?
Thanks

<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST' && isset($_POST['form_name']) && $_POST['form_name'] == 'logoutform')
{
if (session_id() == "")
{
session_start();
}
unset($_SESSION['username']);
unset($_SESSION['fullname']);
header('Location: ./entry.php');
exit;
}
?>

[maxime]

i think you should use this code instead

<?php
if (session_id() == "")
{
session_start();
}
unset($_SESSION['username']);
unset($_SESSION['password']);
header('Location: ./entry.php');
?>

[alex4orly]

Dear Maxime,

I am trying to make a point about WWB and wait for Pablo to answer.
If there are objects in WWB that are expected to be working a certain way, it will not be right for me to try and manipulate it to fix.

Thanks again for your help
Cheers

[bburgess]

@alex4orly mate I am learning from your posts and the reply's!

I have been having some issues as well so this is great that questions are asked and I can look them up

Cheers
BB

[Pablo]

As you can see, the code is correct.
So the problem may be in one of the other pages.
To be able to help you I need to see the code of all pages.

[Pablo]

The problem is that you have used the 'single page protect' object to protect the page.
The 'single page protect' object is meant to be used as standalone solution. It does not use a database and uses a different session variable ($_SESSION['password'] vs $_SESSION['username'], see the code). it should not be mixed with the other login tools, it's a stand alone object (see the help).

So logout will not do anything in this case because it resets the 'username' variable.

[alex4orly]

I see, so in a multi page project - how do I protect a specific page?

[Pablo]

In that case you will need to use the 'protected page' object.

Related tutorial:
http://wysiwygwebbuilder.com/login_basics.html

[alex4orly]

The main problem I have here is that I have a single point of entry for the Admin functions
Please have a look here : http://www.nmaa-rc.org.au/
At the bottom of the page on the left the button - click on it and you see TWO objects

1) The Admin object
2) A button to access the page where the DBTS CSV List object is

Logically, I would have liked to be able to make this button visible only AFTER - the Initial Admin is logged into the object
I tried all sorts of ideas but can't seem to make it.

If I could do that, I would not need at all to protect the page and once the Admin logs out - the Dataviewer will also be hidden

Any suggestions?

[Pablo]

The admin section and the protected pages are two different levels.

The login of the admin prevent normal users from accessing the admin tools.
The normal login prevents anyone from accessing the protected page.
Normally the visitor and the admin are two different people.

If you wish to use the same password for the admin and the protected page then you will need to modify the scripts.

[alex4orly]

I am talking here about the duties of an Admin person
He / she is the one to maintain the members database
He / She is the one to see a list / report of the database
The two functions are tightly related, it is NOT two different people

All that I want, is to be able to place a button on the page AFTER the admin logs in, what this button does is not the point here
It seems to me to be very simple to add this functionality to the Admin object, I mean - "Simple" for someone who knows how to do it, even more simple to the designer of this module.

I wonder, am I the first / only one who has ever asked for such thing?

With the current scenario, the admin is required to log in twice on the same page, this is NOT a nice option

Cheers

[Navaldesign]

But, if all of the above are only for the Administrator to see, why don't you simply place all the pages / files in a protected folder ?
A protected folder can be setup directly in your hosting account control panel, and the Admin can simply login once and do all he has to do.

[alex4orly]

George
I am talking about the interface....
The admin module has a front login, it would make sense to that once the admin person logs in, he is the only one who can access the relevant objects.
Otherwise he needs to log in twice
What for?
Protecting it kn a folder will not change this.
Can the admin object be set without the login step?
If i could. I wkuld have placed it + the dbts report under one skngle protected page with a single login
Cheers

[alex4orly]

One more thing, the same membership database is used for club members to log into their functions, if I was to hide it in a protected folder, they will be locked out. Please have a look here : http://www.nmaa-rc.org.au/

At the bottom of the page on the left the button - click on it and you see TWO objects

1) The Admin object - to access this, the admin needs to LOGIN, is there a way to avoid this step?
2) A button to access the page where the DBTS CSV List object is, the Admin guy needs to log in again...

Logically, I would have liked to be able to make this button visible only AFTER - the Initial Admin is logged into the object
I tried all sorts of ideas but can't seem to make it. Alternatively, be able to pass the Login stage of item #1 above

I will be happy to go with either option, if someone tells me how....

Cheers

[Pablo]

I wonder, am I the first / only one who has ever asked for such thing?

Yes, you are the first user who has asked this.

I'm sorry at the moment this is how it works.
I think what you want is very specific ,so you will need to make the modifications yourself.

Please understand that these tools were designed as a basic login system. This is not a solution that can be used for any possible scenario you can think of. There is no way to design a script that will do that.
There is always someone that want is to behave slightly different. No matter how hard I do my best, there are sometime users I have to disappoint.
But if you have suggestions for future development then I will consider it for later updates.

[alex4orly]

I understand Pablo, there are only 24 hours a day...

Suggestions:

1) In the Admin setup dialog, setup a flag to enable bypassing of the login. If that was an option - we could place the admin object on a page that we could use the page protect object and place on that same page other objects providing all the functionality with one single login.
AND / OR
2) In the above mentioned setup dialog, add an option for an extra button, the button text, and what other page will the button call when clicked.

Also regarding this Admin object. With any website that I visit and need to log in, there is a timeout and there is no situation that I can visit my Bank account for example after closing the browser WITHOUT logging out and I will still be logged into my session, why is it the case here?

Thanks again for your help

[Pablo]

1) In the Admin setup dialog, setup a flag to enable bypassing of the login. If that was an option - we could place the admin object on a page that we could use the page protect object and place on that same page other objects providing all the functionality with one single login.

This will not be possible because the admin script runs on a different page, so that page is not automatically protected.

2) In the above mentioned setup dialog, add an option for an extra button, the button text, and what other page will the button call when clicked.

I will think about this.

Also regarding this Admin object. With any website that I visit and need to log in, there is a timeout and there is no situation that I can visit my Bank account for example after closing the browser WITHOUT logging out and I will still be logged into my session, why is it the case here?

If you close the browser windows then this will end the login session. The timeout is meant to close the session when you forget to close the window. it's a standard PHP feature.

[alex4orly]

The timeout for some reason doesn't work for me
I tried it with several browsers and all the same
I stay logged into the page : loginadmin.php

I really don't know what to do about it, my club Administrator is concerned that the members list stays exposed

[lummis]

@alex4orly I may be misunderstanding what you are trying to do but it does seem as though you may be over-complicating things.

My approach would be to have a separate page for the login object - this can be accessed either from your menu or a button labelled Admin which directs the administrator to the login page by means of a link. Then make all the pages that the administrator needs to access as sub pages of the login page and add the protect page object to each of the sub pages. In the Login Object properties, make the first sub page the Destination Page. Depending on how many sub pages you have you may wish to place a menu on this Destination Page linking to the other sub pages.

This way once the Administrator has logged in he/she has access to all the other protected pages and does not have to login again. The sub pages can have access to the database and depending on what you want to do you can use the various extensions to help. I currently use the DBTS Form Processor, MySQL Connector, MySQL Table Editor and the Dataviewer extensions in my protected sub pages.

I have made the assumption that the Administrator is the only person needing to access the database and that you do not want members to have access as this may make it a bit more complicated.

Unfortunately I am about to go away for a couple of weeks otherwise I would have tried to set up a dummy wbs file to show you how this works.

Brian

[alex4orly]

Brian,

This is exactly what I am trying to say - I want to simplify this, not complicate it.
I want to be able to have ONE single access page, protected by ONE login object, and once the Administrator logs in, there will be on that page several other objects / links which DO NOT need again to be logged into

If the Admin object could have been set without the need to have a login, that would be the best option here.
Please look at my site here : http://www.nmaa-rc.org.au
At the bottom, left hand side there is a button labelled "Admin", click on it - there are two objects on this page, the Admin Login object and the Reporting button object.

In the current tools, each of them needs to be logged in separately which in my mind is a big nuisance, once logged in, each of them requires a Logout action... Instead, if the Admin Object could be setup WITHOUT the need to log in, I could setup ONE single protected page, on it place all the objects I need, all will be accessed by that single page login.

The club members have their own login on the top right, they each need to access their own membership record, to update details and renew membership. It is all in the same database.

Thanks for you comments and have a good time
Alex

[lummis]

Alex - I am on a different time frame here in the UK so have only just seen your reply. I think that the confusion has arisen as you are using two different objects - the Admin and the Login - to achieve the same purpose. By using just the Admin object on a separate page this should produce a list of all the members with the ability to add, delete, or edit any of the information in the table that contains the details of your members. The only thing I don't know is whether you are also looking for the Administrator to be able to amend data in a different table as that will make life a bit more difficult.

Brian

[alex4orly]

Brian,

We all leave in different time zones, no need to apologise, I appreciate any comments whenever they come...
I know that the management list comes on another page after I log in, I do use that object for Add, Edit and delete members.
I am also using another object - an Extension - DBTS CSV List from Navaldesign, but that is to generate a report of the members list.
Both objects need to be locked for anybody else other than the Club Administrator.

I tried to add a button to the Add, Edit, Delete page so as to be able to call the other page with the report in it, but my PHP knowledge is insufficient to achieve this.

Cheers
Alex

[Navaldesign]

I'm on holiday till tuesday. On retutn i will try to provvide you a piece of code to use in a "login" page to allow a single login both for
the members area and the DBTS CSV lista.

[alex4orly]

Enjoy your holiday

Cheers