2. PHPRunner General questions
  3. Bypassing the login screen as guest...
This topic is locked

Bypassing the login screen as guest...

 		8/9/2010 4:11:03 PM
PHPRunner General questions
C
 CodeDog author

I've searched the forums, and found a number of threads with similar questions (such as the one linked below), but haven't found an answer.
http://www.asprunner.com/forums/topic/14869-accessing-parts-of-database-without-having-to-log-in/
I've been manually recoding files to achieve this but it's a pain on every regeneration and I'm thinking there must be a better way to do it.
What I want to do is pretty simple: I want login security on the files for administration, but I want direct 'guest' access to the files without having to go through the login screen.
For example, I want to put a data file listing in an iframe on a web page that displays data immediately, without having to click anything, but does not have any editing controls. However, I also want to be able to link to the login page for administrators to modify data.
Generating a system without a login gives automatic access to the editing controls, and generating a system with edit access control will always display the login screen.
I know I can give read-only access to guests, but they still have to click Login As Guest. I want to create a link in an iframe that gives immediate read-only access, but still be able to provide a separate link to the administrative login.
It seems like this would be a normal thing to want to do, but I can't find anything within PHPRunner that provides for this. Any help would be greatly appreciated...
A
 		ann 8/10/2010

Hi,
while you created a Guest account you don't need to access login page.

Just change the startup page in the generated \output\index.htm file.
C
 		CodeDog author 8/10/2010

Thanks for the reply, Ann, but when I bypass the login page by directly linking to another file (xxxxxxx_list.php for example) the system seems to assume administrative access and allows editing. I've tried it on multiple browsers and computers to eliminate the possibility of a cookie/cache issue. Unless I'm misunderstanding your post.
My first thought a while back for a simple work around was to generate two systems for the same database, one with a login and one without a login, but of course that doesn't work because the system with no login assumes administrative access.
A nice option on the Security page of PHPRunner would be one that doesn't require a login page but allows only guest access (no edit ability).
Sorry if I'm misunderstanding your post, but it seems bypassing the login page allows editing...
C
 		CodeDog author 8/10/2010

Sorry for the double post, but I just realized (according to the way I just tested this) that there could be a potential security risk here. Please correct me if I'm wrong.
While using a PHPRunner system the browser shows the name of the PHP file being used in the address bar. I just asked a colleague to type the address into her browser to go directly to the xxxxxxx_list.php file and it brought up the list with add/edit ability without her having to login. Further testing shows that some versions of IE bring up an error page and some access the page, and in FF it seems to always go directly to the page as if you were logged into the system.
It seems that it's possible to bypass a system's login security by linking directly to a list file, but I would think that if this was the case someone would have mentioned it long ago. As I said, I could very well be wrong, please correct me if I am...
A
 		ann 8/11/2010

Hi,
you need to set up readonly access for the Guest user on the User Group Permissions dialog on the Visual Editor tab.