codeigniter中的授权

Question

我正在使用 codeigniter，我正在做一个身份验证系统 - 用户可以登录，他可以看到所有页面，然后他可以注销。问题是下一个：为什么注销的用户可以在没有登录的情况下看到所有页面。我该如何纠正它？这是我的控制器：

 <?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class User extends CI_Controller {

public function __construct() {
    parent::__construct();
    $this->load->helper(array('url', 'form'));
    $this->load->model("usermodel");
    $this->load->library('session');
}

private function view($page, $data=false) {
  if($page == "auth/login" ){
        $this->load->view("auth/header_auth.php");
    }else{
        $this->load->view("header.php");
  }

  $this->load->view($page, $data);
  $this->load->view("footer.php");
}

public function index() {
  if ($this->session->userdata("user")) {
      redirect("dashboard", "refresh");
      return;
  }
  $this->view("auth/login");
}

public function fail() {
  $this->view("auth/login");

}

public function dashboard() {
  $this->view("auth/dashboard");
}

public function login() {
  $login = $this->input->post("login");
  $password = $this->input->post("password");
  if ($this->usermodel->login($login, $password)) {
      $this->session->set_userdata("user", $login);
      redirect("dashboard", "refresh");
  } else {
      redirect("fail", "refresh");
  }
}

public function logout() {
  $this->session->unset_userdata('user');
  session_destroy();
  redirect('index', 'refresh');
}

}

Answer 1

您必须在每个必须具有用户权限才能查看的功能开始时检查用户是否已登录

if (!$this->session->userdata("user")) {
  redirect("auth/login", "refresh");
}

我假设你的视图功能只有在用户登录的情况下才能查看，更改

private function view($page, $data=false) {
    if($page == "auth/login" ){
        $this->load->view("auth/header_auth.php");
    }else{
      $this->load->view("header.php");
  }

   $this->load->view($page, $data);
   $this->load->view("footer.php");
 }

到这里

private function view($page, $data=false) {
if (!$this->session->userdata("user")) {
    redirect("auth/login", "refresh");
}
    if($page == "auth/login" ){
        $this->load->view("auth/header_auth.php");
    }else{
      $this->load->view("header.php");
  }

   $this->load->view($page, $data);
   $this->load->view("footer.php");
 }

更新

每个人都可以查看您的仪表板，以使其只能由登录用户查看：

public function dashboard() {
  if (!$this->session->userdata("user")) {
    redirect("auth/login", "refresh");
  }
  $this->view("auth/dashboard");
}