Admin only access to articles. Is this secure?

Peekay · Post by **Peekay** » Thu 22. Sep 2005, 18:51

Can someone pick holes in this.

I have a client whose present website is controlled by a custom data entry form and a PHP script. The form is accessed with a username and password via an 'admin' page.

I am trying to replicate this scenario using PHPWCMS 1.2.3 and wondered if the following method will ensure that only the client has access to the form.

1) I created a category called 'scripts'
2) I gave the category the alias 'scripts'.
3) I selected 'Hide' (from main menu) and 'Visible for users logged on only'
4) I addded an article to this category with the entry form and PHP script and created the custom tables in the database.

When I log in to the backend I can open this page and use the form. If I am not logged in, I cannot see the page. This is exactly what I want, but I am concerned that there may be a loophole somewhere.

Comments from anyone who can see a problem (or a better way) would be welcome.

jsavage · Post by **jsavage** » Sat 24. Sep 2005, 21:16

I haven't checked recently but there was a vulnerability involving the rss feed displaying content that was otherwise not visible. You could always remove the rss.php script if this is the case but worth being aware of and checking.

James

Peekay · Post by **Peekay** » Sat 24. Sep 2005, 21:24

Thx for that info jsavage. I'll check that out.

I'm sure the 'visible only if logged in' feature never worked in earlier versions of PHPWCMS (apologies if I'm wrong about that). It will be nice if it can be utilised to create pages visible to admin users only.

Post by **Oliver Georgi** » Sun 25. Sep 2005, 22:08

"Visible for users logged on only" still not working at the moment. But you can uncheck "visible" and "public" - then you can edit articles and nobody not logged is able to see the article you are still working on...

Oliver

goshen · Post by **goshen** » Tue 27. Sep 2005, 16:37

Indeed, I found that unchecking all 4 boxes (the two at the top, and at the bottom of a structure level) would hide the structure level, but as soon as you were logged in, they show up. This works fine, although i think you have to make each article "Non Public" too, or you can get to them through a direct link, for example if someone flukes the address, or you put a link elsewhere.

Post by **Oliver Georgi** » Tue 27. Sep 2005, 17:58

structure hiding is just a visible question and has nothing to do with secure access...

Oliver