在codeigniter中授权

Question

I'm working with codeigniter, I'm doing an auth system - user can log in, he can see all pages, after he can log out. The problem is next: why logged out user can see all pages without to be logged in. how can I correct it? This is my controller:

 <?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class User extends CI_Controller {

public function __construct() {
    parent::__construct();
    $this->load->helper(array('url', 'form'));
    $this->load->model("usermodel");
    $this->load->library('session');
}

private function view($page, $data=false) {
  if($page == "auth/login" ){
        $this->load->view("auth/header_auth.php");
    }else{
        $this->load->view("header.php");
  }

  $this->load->view($page, $data);
  $this->load->view("footer.php");
}

public function index() {
  if ($this->session->userdata("user")) {
      redirect("dashboard", "refresh");
      return;
  }
  $this->view("auth/login");
}

public function fail() {
  $this->view("auth/login");

}

public function dashboard() {
  $this->view("auth/dashboard");
}

public function login() {
  $login = $this->input->post("login");
  $password = $this->input->post("password");
  if ($this->usermodel->login($login, $password)) {
      $this->session->set_userdata("user", $login);
      redirect("dashboard", "refresh");
  } else {
      redirect("fail", "refresh");
  }
}

public function logout() {
  $this->session->unset_userdata('user');
  session_destroy();
  redirect('index', 'refresh');
}

}

Answer 1

you must check if user is logged in at beginning of each function which must have user privileges to view

if (!$this->session->userdata("user")) {
  redirect("auth/login", "refresh");
}

I am assuming that your view function can only be viewed if a user is logged in, change

private function view($page, $data=false) {
    if($page == "auth/login" ){
        $this->load->view("auth/header_auth.php");
    }else{
      $this->load->view("header.php");
  }

   $this->load->view($page, $data);
   $this->load->view("footer.php");
 }

to this

private function view($page, $data=false) {
if (!$this->session->userdata("user")) {
    redirect("auth/login", "refresh");
}
    if($page == "auth/login" ){
        $this->load->view("auth/header_auth.php");
    }else{
      $this->load->view("header.php");
  }

   $this->load->view($page, $data);
   $this->load->view("footer.php");
 }

Update

also your dashboard can be viewed by everyone, to make it viewable only by logged in user do this:

public function dashboard() {
  if (!$this->session->userdata("user")) {
    redirect("auth/login", "refresh");
  }
  $this->view("auth/dashboard");
}