How to protect a new folder and files inside manager?

Hi, I’ve set up a folder containing some PHP files that query and get results from a db (separate to the modX db), basically these will be used by some people with very low level access, to this specific db.

I’ve edited the /assets/templates/manager/welcome.html to include a new tab on the welcome splash screen inside the backend, which links ton the pages that query and edit this db. When clicked on, the link opens up the relevant pages in the window inside the backend, and all seems to work fine.

Which is all great, EXCEPT that these query forms can be accessed by the public even though they’re housed inside the http://<domain>/manager area.

So how can I make it so that anyone attempting to browse to these form pages gets redirected to the backend login.html, unless of course they’ve already logged into it in which case they shouldn’t need to be prompted again?

This needs to be made as a module.

Simply create a new module, and add your code into the module.
Once you run the Module a new tab will show up under Modules, and your users can access the bespoke functionality there.

Your pages are not protected as essentially they are no in the manager at all.

When you say add the code into the module, how should it be added? Should all the code for each of the pages be dumped straight into the module? Not sure how that would work. There’s an area for "Module Code" but I’m not clear what should go in there. There are four or five distinct PHP pages each with their own db queries and operations.

Can anyone clarify how this should be done please?

thanks

Anyone?!

Well there are lots of existing posts on how to make a module in modx if you search the forum (EDIT google ’modx modules’ the forum search here sucks!) which is most likely why you haven’t had an answer yet Anyhow, you might want to look at this generic ’module maker’ which should make it as painless as possible (be sure to follow the included doc):
http://modxcms.com/forums/index.php/topic,39174.0/

You could also read this article:
http://www.sottwell.com/create-module.html

And the wiki:
http://wiki.modxcms.com/index.php/Creating_Modules

Good luck!

Thanks, I’ll take a look at those links...

Maybe I’m misunderstanding what you’re doing but it looks like you could just put a simple snippet at the top of the pages that would check the user’s login status and redirect not-logged-in users to the login page.

<?php
if (!getLoginUserID()){
$modx->sendRedirect($modx->makeURL(##));
}
?>

Where ## is the document ID of the login page.

isFrontEnd() and isBackEnd() are also available if you need to distinguish between them.

That sounds ideal- I will try adding this to the top of the relevant pages.

thanks

[Hmm - just tried this...

Added this code to the top of one of the PHP files:

<?php
if (!getLoginUserID()){
$modx->sendRedirect($modx->makeURL(../welcome.html));
}
?>

So in theory it should take non-logged in people to the Manager backend welcome page. But instead it just brings up a blank page. Any ideas?

There are also the snippets MemberCheck and ManagerCheck
that check if a user is a member or a manager on each case
and show a chunk just for them...