目录应用程序安全

Question

所以，我有两种类型的用户可以登录或注册：商家或买家。

当我以买家身份登录时，使用：action="check_buyer.php"，它会将我重定向到我网站上的login/buyer/。但是，现在，一旦登录，我可以将 url 从 login/buyer 更改为 login/merchant 并且它可以工作。我该如何防止这种情况？如您所见，我正在使用会话...

我如何在 PHP 中执行下面的检查 $_POST['userPermission'];，它将作为 INT(1) 存储在数据库中并在我的会话中调用？？

<?php
session_start(); #recall session from index.php where user logged include()

require_once('../inc/db/dbc.php');
$connect = mysql_connect($h, $u, $p) or die ("Can't Connect to Database.");
mysql_select_db($db);

$LoginUserName = $_POST['userName'];
$LoginPassword = mysql_real_escape_string($_POST['userPass']);
//connect to the database here
$LoginUserName = mysql_real_escape_string($LoginUserName);
$query = "SELECT uID, uUPass, dynamSalt
        FROM User
        WHERE uUName = '$LoginUserName';";
$result = mysql_query($query);
if(mysql_num_rows($result) < 1) //no such USER exists
{
    echo "Invalid Username and/or Password";
}
$ifUserExists = mysql_fetch_array($result, MYSQL_ASSOC);

$dynamSalt = $ifUserExists['dynamSalt'];  #get value of dynamSalt in query above
$SaltyPass = hash('sha512',$dynamSalt.$LoginPassword); #recreate originally created dynamic, unique pass

if($SaltyPass != $ifUserExists['uUPass']) # incorrect PASS
{
    echo "Invalid Username and/or Password";
}

else {
validateUser();
}
// If User *has not* logged in yet, keep on /login
if(!isLoggedIn())
{
    header('Location: index.php');
    die();
}

function validateUser()
{
    session_regenerate_id ();
    $_SESSION['valid'] = 1;
    $_SESSION['uID'] = $userid;
}

function isLoggedIn()
{
    if(isset($_SESSION['valid']) && $_SESSION['valid'])
        header( 'Location: buyer/' ); # return true if sessions are made and login creds are valid
    echo "Invalid Username and/or Password";  
    return false;
}
?>

Answer 1

您应该在登录会话时保存用户类型并检查页面标题是否类型正确或关闭页面/重定向/显示消息...

例子：

1.- 从表中检索 $type，例如从“userType”字段中

$query = "SELECT uID, uUPass, dynamSalt,userType FROM User WHERE uUName = '$LoginUserName';";

2.- 登录时添加到会话中的类型值

function validateUser() {
    session_regenerate_id ();
    $_SESSION['valid'] = 1;
    $_SESSION['uID'] = $userid;
    $_SESSION['type'] = $userType; // 1 for buyer - 2 for merchant
}

3.- 在每个仅限用户的页面上，使用头部代码来获取用户是否有效

买家专用页面示例：

session_start();
if($_SESSION['type']!=1){ die("You are not a buyer. Access denied"}

// The rest of your page here

商家页面示例：

session_start();
if($_SESSION['type']!=2){ die("You are not a merchant. Access denied"}

// The rest of your page here