PHP 5 - 保护站点的管理区域

Question

I'm currently writing a couple of MVC sites using Kohana as my framework. Each has a simple admin area where the admin can upload and edit content. I'm currently storing the admin's user model in a session and checking whether or not they're an administrator with the following method:

private function checkAdmin()
{
    if (!isset($_SESSION['admin']) || $_SESSION['admin']->Level !== 'admin')
    {
        header('Location: /admin');
        exit;
    }
}

I call this method in all of the other Admin controller methods, like so:

public function writeReview()
{
    $this->checkAdmin();

    // rest of the method
}

I'm just wondering if there's anything I can do to improve this. It just seems like a single point of failure that's giving me a bad smell, so I'm a bit weary to move on before getting this nailed down.

Answer 1

1. Your function appears to be redirecting to /admin only if the user is not an administrator. If that's the intended result, then fine.

2. -- Forget this, my mistake.

3. The checkAdmin() function, as it relies on a redirect, is only useful in situations where you want to redirect. If, for example, you are using this in the processing script (and you should be checking if it's an administrator in the processing script), you just want a return true or return false. I suggest that be the base function, and a redirect function call that, or alternative, accept and optional parameter to redirect.