如何检查用户是否为admin SECURE

Question

I made a login function with bruteforce protection, different bot protection functions like honeypot.., input filtering, Argon2 encrypted password.

But in the end to identify the user i save the id inside a session after a successful login. With this id until now i checked if the column "admin" has the value 1 or 0.

If this value is 1 the user can do everything.

How i could improve the security ?
How else i could check if a user is an admin ?

Answer 1

You should do as I will direct you

As long as you have user id in act so it's half of the way

I will assume that you have function.php which have all the functions you use in website

Also you have login function that check user account details and give access You now need to improve that to restrict user access

First: Create table in MySQL call it group this table will have two records or as you like so. Admin will have id 1 and members id 2 then you can make much modifications like make another column in that table called upload and set admin to yes while members to no

Second in your login function use the following

    $res = mysql_query("SELECT * FROM users INNER JOIN group ON users.class=group.group_id WHERE users.enabled='yes' AND users.status = 'confirmed'") or die(mysql_error());
$row = mysql_fetch_array($res);

Users.class is the group id and users is the table users Now you can check group credits as example if on upload page you do the following

    if($row["can_upload"]=="no")
    echo("admin only can upload ");

You can check credentials on group as you need also you can make much classes like admin , members, uploders, reviewers,authors and give every class special permissions as website content is viewed

On admin.php you can use

    if($row["admin"]=="no")
    ech("admin only can view this page ");

In both examples above Admin and can_upload is colum in group table and it's changed by user class .