You are here:  » Looking to outsource some admin work - Security Questions

Support Forum



Looking to outsource some admin work - Security Questions

Submitted by paddyman on Thu, 2010-09-02 11:35 in

Hi David,

Hope all is well.

I have a site with a large number of products and am looking at outsourcing some of the product mapping. Currently I have my password set to http://mysite.com/admin set in congfig.advanced.php and the menu in admin pointing to various links including your admin/productsmap.php and admin/finder.php mods.

I would prefer only to allow access to the above 2 files and block access to the main admin section, etc. for the person doing the product mapping.

All I can think of is to create another admin folder and admin menu only pointing to these files.

Do you know of any better way to do this, or should I go with the above ?

Many thanks

Adrian

Submitted by support on Thu, 2010-09-02 12:43

Hi Adrian,

It's almost as simple as you suggest.

1) Create a new folder /admin2/

2) Into that folder, copy the following files from /admin/

productsmap.php
finder.php
admin_footer.php
admin_header.php

3) Create a new /admin2/index.php file containing the following:

<?php
  
require("../includes/common.php");
  
$admin_checkPassword TRUE;
  require(
"../includes/admin.php");
  require(
"admin_header.php");
  require(
"admin_menu.php");
  require(
"admin_footer.php");
?>

4) Create a new /admin2/admin_menu.php containing the following:

<?php
  
print "<div class='menu'>";
  print 
"<p>";
  print 
"<small>";
  print 
"<a href='".$config_baseHREF."'>Site Home</a>&nbsp;&nbsp;";
  print 
"<a href='".$config_baseHREF."admin2/'>Admin Home</a>&nbsp;&nbsp;";
  print 
"|&nbsp;&nbsp;";
  print 
"<a href='productsmap.php'>Product Mapping</a>&nbsp;&nbsp;";
  print 
"<a href='finder.php'>Product Finder</a>&nbsp;&nbsp;";
  print 
"</small>";
  print 
"</p>";
  print 
"</div>";
?>

5) In config.advanced.php, add a new password for /admin2/

  $config_admin2Password = "password";

6) Edit includes/admin.php and look for the following code beginning at line 538:

  if ($admin_checkPassword)
  {

...and REPLACE that with:

  if ($admin_checkPassword)
  {
    if (strpos($_SERVER["REQUEST_URI"],"admin2"))
    {
      $config_adminPassword = $config_admin2Password;
    }

That should get you pretty close to what you need!

Cheers,
David.
--
PriceTapestry.com

Submitted by paddyman on Thu, 2010-09-02 13:28

Thanks David,

Will give that a try.

Cheers

Adrian