Page 1 of 1

How does this redirection work? (phpBB authorizing code)

Posted: Sun May 23, 2004 10:00 am
by scavok
I'm trying to edit the phpbb source to make it so only people I give "permission" to see a page, can see the page. How I'm trying to do this is using the code that they're using to check if the user is authorized to view certain forums.

There is a forum I set up, who permits the same people who can view the pages I'm trying to permit, to view it. This forum's id in the database is "3"

For this example, I'm trying to make it so search.php is only viewable to people who are authorized to view forum 3. If they're not authorized, it will say so, just like if they're not authorized to view a forum they try to access.

Here is the authorizing code before I edited it:

Code: Select all

$is_auth = array(); 
$is_auth = auth(AUTH_ALL, $forum_id, $userdata, $forum_row); 

if ( !$is_authї'auth_read'] || !$is_authї'auth_view'] ) 
{ 
   if ( !$userdataї'session_logged_in'] ) 
   { 
      $redirect = POST_FORUM_URL . "=$forum_id" . ( ( isset($start) ) ? "&start=$start" : '' ); 
      redirect(append_sid("login.$phpEx?redirect=viewforum.$phpEx&$redirect", true)); 
   } 
   // 
   // The user is not authed to read this forum ... 
   // 
   $message = ( !$is_authї'auth_view'] ) ? $langї'Forum_not_exist'] : sprintf($langї'Sorry_auth_read'], $is_authї'auth_read_type']); 

   message_die(GENERAL_MESSAGE, $message); 
}
Here it is after I edited it:

Code: Select all

<?php 
define('IN_PHPBB', true); 
$phpbb_root_path = './'; 
include($phpbb_root_path . 'extension.inc'); 
include($phpbb_root_path . 'common.'.$phpEx); 

$is_auth = array(); 
$is_auth = auth(AUTH_ALL, 3, $userdata, $forum_row); 

if ( !$is_auth&#1111;'auth_read'] || !$is_auth&#1111;'auth_view'] ) 
&#123; 
   if ( !$userdata&#1111;'session_logged_in'] ) 
   &#123; 
      redirect(append_sid("search.php", true)); 
   &#125; 
   // 
   // The user is not authed to read this forum ... 
   // 
   $message = ( !$is_auth&#1111;'auth_view'] ) ? $lang&#1111;'Forum_not_exist'] : sprintf($lang&#1111;'Sorry_auth_read'], $is_auth&#1111;'auth_read_type']); 

   message_die(GENERAL_MESSAGE, $message); 
&#125; 

$template->pparse('body'); 

include($phpbb_root_path . 'includes/page_tail.'.$phpEx); 

?>
What this does is just constantly redirect the user back to search.php where it executes the redirection code again non-stop. Like a never ending loop.

I also tried this:

Code: Select all

if ( !$is_auth&#1111;'auth_read'] || !$is_auth&#1111;'auth_view'] )
&#123;
	if ( !$userdata&#1111;'session_logged_in'] )
	&#123;
		$redirect = POST_SEARCH_URL . "=1" . ( ( isset($start) ) ? "&start=$start" : '' );
		redirect(append_sid("login.$phpEx?redirect=search.$phpEx&$redirect", true));
	&#125;
	//
	// The user is not authed to read this forum ...
	//
	$message = ( !$is_auth&#1111;'auth_view'] ) ? $lang&#1111;'Forum_not_exist'] : sprintf($lang&#1111;'Sorry_auth_read'], $is_auth&#1111;'auth_read_type']);

	message_die(GENERAL_MESSAGE, $message);
&#125;
Here is the code for the redirect function:

Code: Select all

function redirect($url)
&#123;
	global $db, $board_config;

	if (!empty($db))
	&#123;
		$db->sql_close();
	&#125;

	$server_protocol = ($board_config&#1111;'cookie_secure']) ? 'https://' : 'http://';
	$server_name = preg_replace('#^\/?(.*?)\/?$#', '\1', trim($board_config&#1111;'server_name']));
	$server_port = ($board_config&#1111;'server_port'] <> 80) ? ':' . trim($board_config&#1111;'server_port']) : '';
	$script_name = preg_replace('#^\/?(.*?)\/?$#', '\1', trim($board_config&#1111;'script_path']));
	$script_name = ($script_name == '') ? $script_name : '/' . $script_name;
	$url = preg_replace('#^\/?(.*?)\/?$#', '/\1', trim($url));

	// Redirect via an HTML form for PITA webservers
	if (@preg_match('/Microsoft|WebSTAR|Xitami/', getenv('SERVER_SOFTWARE')))
	&#123;
		header('Refresh: 0; URL=' . $server_protocol . $server_name . $server_port . $script_name . $url);
		echo '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><meta http-equiv="refresh" content="0; url=' . $server_protocol . $server_name . $server_port . $script_name . $url . '"><title>Redirect</title></head><body><div align="center">If your browser does not support meta redirection please click <a href="' . $server_protocol . $server_name . $server_port . $script_name . $url . '">HERE</a> to be redirected</div></body></html>';
		exit;
	&#125;

	// Behave as per HTTP/1.1 spec for others
	header('Location: ' . $server_protocol . $server_name . $server_port . $script_name . $url);
	exit;
&#125;
I'm pretty sure I did nothing right, I know this won't be as simple as I'm trying to make it out to be. These are more or less examples of how clueless I am.

I don't understand how their redirection code works. How is it redirecting the user to another page without having to authorize the user again? I just need to make it so the page doesn't load unless they're authorized to view it.