joomlaのログイン資格情報を検証してください！コア構造

Question

私はjoomla用のプラグインを開発中です！スクリプトの複雑さを考えると、私はそれをコア構造から設計しました。

私が抱えている唯一の問題は、ユーザーが管理者として一度だけログインし、プラグインフォルダにアクセスできないようにすることです。

私のプラグインは:(パス[ドット] com/test）フォルダにありますが、すべて正常に動作しますが、一般公開されています。

これまでのところ、私は（テスト/ index.phpを）から試してみましたが、このコード：

// Load Joomla! configuration file 
require_once('../configuration.php'); 
// Create a JConfig object 
$config = new JConfig(); 
//import variables 
$dbhostname  = $config->host; 
$dbusername  = $config->user; 
$dbpassword  = $config->password; 
$dbdatabase  = $config->db; 
$dbprefix  = $config->dbprefix; 
$secret   = $config->secret; 

// Get these from your form... 

    $username_for_check = 'admin'; // this username should be in your database = change it 

    $password_for_check = 'passw'; //this password should be in your database encrypted = change it 

//connect to db 
    $mysqli = new mysqli($dbhostname,$dbusername,$dbpassword,$dbdatabase); 

    if ($result = $mysqli->query('SELECT j.username,j.password FROM '.$dbprefix.'users j WHERE j.username="'.$username_for_check.'" LIMIT 1;')) { 

     if ($result->num_rows == 0){ 
     echo 'Username does not exist.'; 
     } 
     else{ 
     while ($row = $result->fetch_object()) { 

      //Grab username and password from table #__users 
      $joomla_user = $row->username; 
      $joomla_pass = $row->password; 


      $pass_array = explode(':',$row->password);// <== Here not sure!! 
      //but it should be the magic behind it.. for me doesn't work in joomla 3.5 and above apparently as encryption method changed 
      //my password does not have a colon in between 

      //\\===\ Those are just echos to visually check if the password was matched /==//\\ 

      echo '[USER:] '.$joomla_user.'<br>'; 

      echo '[PASS:] '.$joomla_pass.'<br>'; 

      echo '[HASH:] '.$joomla_hash = $pass_array[0].'<br>'; 

      echo '[SALT:] '.$joomla_salt = $pass_array[1].'<br>'; 

      echo '[SECRET:] '.$secret.'<br>'; //secret maybe of help, just put it ready for testing 

      echo '[CHECK:] '.md5($password_for_check.$joomla_salt).'<br>'; 
      //=======================================================================// 
     } 

     if($joomla_hash == md5($password_for_check.$joomla_salt)){ //Old approch for validating according to various prehistoric posts 

      echo 'Username and password combination validated.'; 

     } 
     else{ 
      echo 'Invalid password for username.'; 
     } 

     } 

    } 
    else { 
    echo 'LOGIN VALIDATION: MySQL Error - '.$mysqli->error; 
    } 
    //close db 
    $mysqli->close(); 

試合を返すと、続行する前に登録されたユーザーを確認しようとしています。

誰かがこれ以上の解決策を3.5以上持っていることを願っています。事前に

おかげで

Answer 1

は行うための最善の方法を見つけたそれが役立つだろう。この希望のようなものです誰か：

<?php 
// Load Joomla! configuration file 
require_once('../configuration.php'); 
// Create a JConfig object 
$config = new JConfig(); 
//import variables 
$dbhostname  = $config->host; 
$dbusername  = $config->user; 
$dbpassword  = $config->password; 
$dbdatabase  = $config->db; 
$dbprefix  = $config->dbprefix; 

// Get these from your form... 
    $username_for_check = 'admin'; // this username should be in your database = change it 
    $password_for_check = '1234'; //this password should be in your database encrypted = change it 

    //Something like that from your form 
    //$username_for_check = $_POST['access_login']; 
    //$password_for_check = $_POST['access_password']; 
//connect to db 
    $mysqli = new mysqli($dbhostname,$dbusername,$dbpassword,$dbdatabase); 
    if ($result = $mysqli->query('SELECT j.username,j.password FROM '.$dbprefix.'users j WHERE j.username="'.$username_for_check.'" LIMIT 1;')) { 
     if ($result->num_rows == 0){ 
      echo 'Username does not exist.'; 
     } 
     else{ 
      while ($row = $result->fetch_object()) { 
       //Grab username and password from table #__users 
       $joomla_user = $row->username; 
       $joomla_pass = $row->password; 
      } 
      if(password_verify($password_for_check , $joomla_pass)){ 
       echo 'Username and password combination validated.'; 
      } 
      else{ 
       echo 'Invalid password for username.'; 
      } 
     } 
    } 
    else { 
     echo 'LOGIN VALIDATION: MySQL Error - '.$mysqli->error; 
    } 
    //close db 
    $mysqli->close(); 
?>