是否可以加载需要登录并显示所有用户的仪表板（主控）的小部件

Question

How safe is it? I'm assuming it's not to safe and additionally i'm assuming it's possible but not safe at the same time.

Right now i have a master login that displays data for all users; specifically all the users that are top 10 users. I want to be able to display to everyone on the homepage (login not necessary) the data of these wigits.

Right now I'm using a simple iframe:

<iframe src="https://newuser_news.dhtml?usepage=info-leaders.html" style="width:100%; height: 900px;"></iframe>

But of course, i'm the only one that can view the data, anyone else that i send the link to it boots them back to the homepage that requests a login.

Mind you i'm working a system that i do not have full access to, i do not have access to the classes or methods or the DB. I do have the master username and password access.

I'm super stuck on this... Any help would be greatly appreciated.

Answer 1

The easiest way would be to get some access to the database to make your own modified widget that does not require any login. Maybe the system has an API available that would get you the information you need (or they could make it available).

If you cannot get any access to the database and the system cannot be modified to make that widget login-free, you could write your own widget in php that uses cURL to get the original widget using the username and password and present that. You would have to store the username and password on your server for that, so I would not recommend that solution.