We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

Secure Admin only front end pages

    • 8168
    • 1,118 Posts
    dubbs Reply #1, 10 years, 11 months ago
    Hi guys, I am building out a site which has many front-end pages which are intended to only be accessed by the MODx manager admin users. I already have a little snippet on these pages which means that the page will only render if their is an open MODx manager session in usage - see code below. Can I check how secure this is? I want to make sure these manage only front-end pages are very secure so please advise if there is a better way of doing this.

    Cheers,

    dubbs.

    /* AdminOnly snippet */
if (! $modx->user->isMember('Administrator')) {
   $modx->sendUnauthorizedPage();
}
      • 28042 ☆ A M B ☆
      • 24,524 Posts
      sottwell Reply #2, 10 years, 11 months ago
      That will work. Or you can simply create a Resource Group connected to the Administrator group for the 'web' context.
        Studying MODX in the desert - http://sottwell.com
        Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
        Join the Slack Community - http://modx.org
        • 28042 ☆ A M B ☆
        • 24,524 Posts
        sottwell Reply #3, 10 years, 11 months ago
        You'll need to give Anonymous group (and any other user groups) load-only access to that resource group if you want them to go to the unauthorized page, otherwise they'll get the not-found error page.
          Studying MODX in the desert - http://sottwell.com
          Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
          Join the Slack Community - http://modx.org
          • 8168
          • 1,118 Posts
          dubbs Reply #4, 10 years, 11 months ago
          Thanks Susan. So its nice and tight from a security point of view too yeh?
            • 28042 ☆ A M B ☆
            • 24,524 Posts
            sottwell Reply #5, 10 years, 11 months ago
            Even easier, simply unpublish the resources. Only Manager users with permissions to "view_unpublished" can see them.

            pdoMenu even has an option to list unpublished resources in its menus only for logged-in Manager users with view_unpublished permissions.
              Studying MODX in the desert - http://sottwell.com
              Tips and Tricks from the MODX Forums and Slack Channels - http://modxcookbook.com
              Join the Slack Community - http://modx.org