Prevent users from accessing admin area - mysql

Question

Good Day,
am Facing a code error with my Admin control panel PHP page.
I want to prevent any other user from accessign this page unless his job_title= admin.
it works but even the admin himslef redirects back to login page again !!
here is the code
<?php
include('db.php');
?>
<?php
// Inialize session
#session_start();
ob_start();
// Check, if username session is NOT set then this page will jump to login page
if (!isset($_SESSION['name']) || ($_SESSION['job_title'] != "admin")) {
header('Location: index.php');
}
ob_flush();
?>
>?
<!-- STARTING HTML FORMAT !-->
?>
Any help ?

Answer 1

Try this, if still problems, let me know.
$_SESSION['name'] = 'dennis';
$_SESSION['job_title'] = 'admin';
if (!isset($_SESSION['name']) || (!isset($_SESSION['job_title']) ? false: ($_SESSION['job_title'] !== 'admin'))) {
echo 'Redirecting';
} else {
echo 'You\'re good! Not redirecting!';
}
This may be an easier way to understand, just put into a function.
$_SESSION['name'] = 'dennis';
$_SESSION['job_title'] = 'admin';
if (!isset($_SESSION['name']) || !isBoss()) {
echo 'Redirecting';
} else {
echo 'You\'re good! Not redirecting!';
}
function isBoss() {
if (isset($_SESSION['job_title']))
if ($_SESSION['job_title'] === 'admin')
return true;
return false;
}

Answer 2

I think your problem is a fubar newline :) Have added login page reference, which is unsetting the session variables you check for if logins fail.
Be very careful with where you put your <?php ?> tags - and in .inc files, such as db.php include - you may leave out the closing ?> tag on last line to avoid accidental ENTER, then CTRL + S failures, sneaking in an unwanted newline char in your output buffer (ob). IF ob_start is activated, nothing is written from server before you choose or script ends. ELSE if its not, default is that every \n will flush output and start the Content part of the payload.
login.php:
<?php
session_start(); // put this on top-most line in your script
$ok = check($_POST['user'], $_POST['pass']);
if($ok) {
$user = db_get_user_creds($_POST['user']);
$_SESSION['name'] = $user['name'];
$_SESSION['job_title'] = $user['job_title'];
} else {
// session_unset();
unset($_SESSION['name']);
unset($_SESSION['job_title']);
}
?>
admin.php
<?php
session_start(); // put this on top-most line in your script
// or, use ob_start at the very first line
// (with no widespace what so ever written out before it)
include('db.php');
?> I am writing out a newline here, session / header section is going to become unstable
<?php
// Inialize session
// #session_start(); moved up top
ob_start();
// Check, if username session is NOT set then this page will jump to login page
if (!isset($_SESSION['name']) || ($_SESSION['job_title'] != "admin")) {
header('Location: index.php');
}
ob_flush();
?>
See the 'I am writing out newline here' bit
A little deeper down rabbithole goes; the communication flow is like this:
1) HEADERS such as
Connection: keep-alive\r\n
Content-Type: text/html\r\n (etc)
2) DOUBLE NEWLINE (one newline with no previous chars on that line)
\r\n
3) CONTENTS
Body
Of Page