25

I have created a magento extension. I want to implement access to the extension. The extension creates a page in frontend and i want only admin to access that page. So basically i need something that would detect that if admin is logged in in frontend pages.

I have tried several solution but noting seem to work .

if(Mage::getSingleton('admin/session', array('name' => 'adminhtml'))->isLoggedIn()) echo 'logged in'; else echo 'not logged in';

Check on frontend if admin is logged in

Mage::getSingleton('core/session', array('name'=>'adminhtml'));
$adminSession = Mage::getSingleton('admin/session');
$adminSession->start();
if ($adminSession->isLoggedIn()) {
   echo 'logged in';
}
0

12 Answers 12

14
+100

The above solutions doesn't work!

Here is a solution that works ( its not that clean ! but this will work anywhere in your application in phtml view or model or controller or helper ! )

$sesId = isset($_COOKIE['adminhtml']) ? $_COOKIE['adminhtml'] : false ;
$session = false;
if($sesId){
    $session = Mage::getSingleton('core/resource_session')->read($sesId);
}
$loggedIn = false;
if($session)
{
    if(stristr($session,'Mage_Admin_Model_User'))
    {
        $loggedIn = true;
    }
}
var_dump($loggedIn);// this will be true if admin logged in and false if not
8
  • 2
    Weird, doesn't work for me at all, reports false no matter what (v 1.7.0.2)
    – joren
    May 28, 2013 at 14:46
  • Null, but I discovered it's an issue with admin session not being available when on a frontend page (I was trying to run this on a CMS page)
    – joren
    May 28, 2013 at 19:28
  • if you its equal null this means you dont have adminhtml session ! try to login i have tested on 1.7 and 1.6 and its working no issues
    – Meabed
    May 28, 2013 at 19:30
  • 7
    This will only work with DB based sessions, not for file based sessions (PHP default) or other session backends like memcache. Jul 30, 2013 at 8:50
  • 2
    It's better to use session_decode($session); if(Mage::getSingleton('admin/session')->isLoggedIn()) ... rather than if(stristr($session,'Mage_Admin_Model_User'))... . That way you're actually decoding the session info rather than relying on a string that might be injected into session data. Nov 28, 2014 at 17:43
8

there is a new magento module, written by alan storm: https://github.com/astorm/Magento_CrossAreaSessions

$adminhtml  = Mage::getModel('pulsestorm_crossareasession/manager')->getSessionData('adminhtml');

$adminUser = $dataAdminhtml['admin']['user'];
$loggedIn = $adminUser->getId() && $adminUser->getIsActive();
1
  • This solution works fine, but if there's no backenduser is logged in, it runs into an error, because $adminUser is null and you try to getId() on null. I'd suggest to check if ($adminUser) before setting $loggedIn, otherwise default to false. Feb 1, 2017 at 10:30
7

Christoph Peters posted a link which solved my problem (Detect if admin is logged in in frontend pages):

//check if adminhtml cookie is set
if(array_key_exists('adminhtml', $_COOKIE)){
   //get session path and add dir seperator and content field of cookie as data name with magento "sess_" prefix
   $sessionFilePath = Mage::getBaseDir('session').DS.'sess_'.$_COOKIE['adminhtml'];
   //write content of file in var
   $sessionFile = file_get_contents($sessionFilePath);

   //save old session
   $oldSession = $_SESSION;
   //decode adminhtml session
   session_decode($sessionFile);
   //save session data from $_SESSION
   $adminSessionData = $_SESSION;
   //set old session back to current session
   $_SESSION = $oldSession;

   if(array_key_exists('user', $adminSessionData['admin'])){
      //save Mage_Admin_Model_User object in var
      $adminUserObj = $adminSessionData['admin']['user'];
      echo 'ADMIN USER IS LOGGED IN';
   }
   else
   {
      echo 'ADMIN USER IS NOT LOGGED IN'
   }
}

Thank you very much Christoph Peters!

1
  • I have tried so many versions of this code and this is the only one that worked for me. No idea why any of the others didn't but happy I've now got it going. Thank you very much Christoph Peters, indeed!
    – Wildcard27
    Apr 8, 2016 at 2:02
3

If you're trying to make it work within the template / phtml files, and/or inside the Block's class you're going to have a hard time. Mainly because magento (aggressively) caches your PHTML blocks for performance purposes thus undoing any program flow control statements you have especially stuff related with cookie checking. I have no direct / lengthy / indepth explanation why but that's just how I've encountered it over and over again.

However, your solution should be correct, but you need to do the check within a controller's preDispatch method like so to avoid the aformentioned aggressive caches since controllers are never cached. (shown in Nick's solution in the question that you linked.):

// Ensure we're in the admin session namespace for checking the admin user..
Mage::getSingleton('core/session', array('name' => 'adminhtml'))->start();

$admin_logged_in = Mage::getSingleton('admin/session', array('name' => 'adminhtml'))->isLoggedIn();

// ..get back to the original.
Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace))->start();

IF you really do need to perform the above checks inside PHTML files or named blocks, check out the following code on how to turn off block-level caching and possibly make it work. What I did before was disable caching for the footer block (in which the child block, not phtml, contains code to check
for a specific cookie)

First off, the block call (found in your local.xml, or module layout update xml, or anywhere you can do layout updates, really. I prefer breaking up my customizations into modules so definitely module layout update xml is the way to go):

<reference name="footer">      
   <action method="unsetData"><key>cache_lifetime</key></action>
   <action method="unsetData"><key>cache_tags</key></action>
   <block type="newsletterpopup/popup" name="newsletterpopup_footer" template="newsletterpopup/popup.phtml"/>
</reference>

And this is the newsletterpopup's block class:

<?php
class Launchpad_Newsletterpopup_Block_Popup extends Mage_Core_Block_Template {
    public function canRender() {
         // Check if cookie exists here       
    }
    public function afterRender() { // if block has rendered, this is called.
        // Set cookie, if it doesn't exist here.
    }
}

And the phtml would be something like:

<?php if($this->canRender()): ?>
   // stuff
<?php endif; ?>

Good luck!

3

Here is a solution this works with Magento 1.7.0.2 (tested) and on each frontend site, I use this in an controller not extending from Mage_Adminhtml_Controller_Action.

https://peters-christoph.de/tutorials/magento-pruefe-admin-session-logi-im-frontend/

3
  • from all of the solution posted here, these is one which is working.. used in fronAction controller May 13, 2014 at 4:27
  • This is the only solution here that worked for me. I had a need to test in a .phtml file and yeps, logged in and out of the admin and it response correctly.
    – Quantum
    Sep 9, 2014 at 21:38
  • Yes, this saved me in a crunch today... Thanks so much. Here's a condensed version: if(array_key_exists('adminhtml', $_COOKIE)){ $sessionFilePath = Mage::getBaseDir('session').DS.'sess_'.$_COOKIE['adminhtml']; $sessionFile = file_get_contents($sessionFilePath); $oldSession = $_SESSION; session_decode($sessionFile); $adminSessionData = $_SESSION; $_SESSION = $oldSession; } if(array_key_exists('user', $adminSessionData['admin'])){ $adminUserObj = $adminSessionData['admin']['user']; } if ($adminUserObj) { // var_dump($adminUserObj); } else { header("Location: /"); die(); }
    – Abbey
    Feb 17, 2015 at 20:23
1

Apart from trying to pull session id from adminhtml cookie, which may or may not work IMHO is better just to "skin" page you need to show to look like its in frontend and use admin controller so it will run under admin session.

Another solution is to "copy" customer from admin to frontend and log them in before hitting your page and then its the matter of just checking if logged in customer is member of some group.

1
  • Thanks i have already done this as a temporary solution. But i need my extension to be accessible by admin only and it would be in frontend.
    – Nirmal Ram
    Apr 19, 2013 at 5:58
1

This code will works

//get the admin session
Mage::getSingleton('core/session', array('name'=>'adminhtml'));

//verify if the user is logged in to the backend
if(Mage::getSingleton('admin/session')->isLoggedIn()) {
  //do stuff
}
else
{
  echo "404 page not found";
}

OR

$adminsession = Mage::getSingleton('admin/session', array('name'=>'adminhtml'));

if($adminsession->isLoggedIn()) {
    //do stuff
} else {
    echo "404 page not found";
}

Did you try to dump the $_SESSION variable? Maybe it will help you get on the right track.

9
  • No man this doesn't work. Neither in controller,model or block.
    – Nirmal Ram
    Apr 19, 2013 at 5:52
  • @NirmalRam it will work, because here it is working, which version of magento you are using? Apr 19, 2013 at 5:57
  • I am using community 1.7. And it doesn't work. Let me explain you. I have created an extension and that extends frontend controller and its displayed in frontend. I just want that to be accessible by admin.
    – Nirmal Ram
    Apr 19, 2013 at 6:02
  • @NirmalRam yes my posted code will work, because I have already developed that type of modules which is only accessible by admin. did you try var_dumping the $_SESSION variable? Apr 19, 2013 at 6:04
  • what session value you got? Apr 19, 2013 at 6:06
1

It is quite simple but not a recommended solution. I myself spend number of hours to do this. For, windows based server try below solution:

$sessionFilePath = Mage::getBaseDir('session').DS.'sess_'.$_COOKIE['adminhtml'];
$sessionFile     = file_get_contents($sessionFilePath); 
$exp_cookie   = explode(';',$sessionFile);
if(count($exp_cookie)   >   100)
{
  return "login";
}
return "expire";    

For, Linux based server try below solution:

$sessionFilePath = Mage::getBaseDir('session').DS.'sess_'.$_COOKIE['adminhtml'];
$sessionFile     = file_get_contents($sessionFilePath); 
$exp_cookie   = explode('--',$sessionFile)
if(count($exp_cookie)   >   10)
{
  return "login";
}
return "expire";

Thanks, Kashif

0

The key to be able to use:

// Ensure we're in the admin session namespace for checking the admin user..
Mage::getSingleton('core/session', array('name' => 'adminhtml'))->start();

$admin_logged_in = Mage::getSingleton('admin/session', array('name' => 'adminhtml'))->isLoggedIn();

// ..get back to the original.
Mage::getSingleton('core/session', array('name' => $this->_sessionNamespace))->start();

is that the controller must extends Mage_Adminhtml_Controller_Action

than you can use this code in the preDispatch function.

And setup the routers for this controller in the admin section of your config.xml.

2
  • If the controller would extend Mage_Adminhtml_Controller_Action then why would i ask this question. Thanks but my controller extends frontend controller and if i would extend it by adminhtml then it would redirect to backend.
    – Nirmal Ram
    Apr 19, 2013 at 5:51
  • You can setup route in a way that the page looks like it is in the frontend (no /admin) and extend Mage_Adminhtml_Controller_Action. Well, I got it working that way for me.
    – user457015
    Apr 20, 2013 at 22:15
0
require_once $dir.'app/Mage.php';
umask(0);

$apps = Mage::app('default');
Mage ::getSingleton('core/session', array('name'=>'adminhtml'));
$adminSession = Mage::getSingleton('admin/session');
$adminSession->start();
if ($adminSession->isLoggedIn()) {
   //echo "logged in";
} 
 else { 
      //echo "Not logged in";
      exit();
 }?> 
-1

Check this blog, I think you need not check with start() before checking with isLoggedIn().

Mage::getSingleton('core/session', array('name'=>'adminhtml')); // get sessions

$check = Mage::getSingleton('admin/session', array('name'=>'adminhtml')); //get admin sessions

    if($check->isLoggedIn()) { //check is admin logged in
        echo "Admin is logged in";
    } else {
        echo "Admin is offline";
    }
2
  • 1
    Your module's adminhtml controller should extend from Mage_Adminhtml_Controller_Action. Else you cant check if admin is logged in.
    – Vishnu R
    Apr 16, 2013 at 13:38
  • No its not like that. I can check.You should try Meabed's answer. It works actually. Just need to test more.
    – Nirmal Ram
    Apr 19, 2013 at 6:00
-1

If you are using cm redis session try this: (worked for me)

$sesId = isset($_COOKIE['adminhtml']) ? $_COOKIE['adminhtml'] : false ;
if($sesId){
    $session = Mage::getSingleton('core_mysql4/session')->read($sesId);
}
$loggedIn = false;
if($session)
{
    if(stristr($session,'Mage_Admin_Model_User'))
    {
        $loggedIn = true;
    }
}

var_dump($loggedIn);

because if you are using cm redis its rewrites db session module with its own model.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.