Check for admin flag / admin session on custom page inside admin folder

[honatto]

Greetings,

I have made a php script that updates a certain product's description with preconfigured HTML code (products_description where product_id=XXX AND language_id=X) based on a form I fill which configures a few php variables within the very same HTML code and then puts it as as final products_description. I have put it into my admin folder in a subfolder. The problem is that anyone with direct link to it site.com/admin/script/index.php (for example) can access it. Which means he can directly edit the product without any admin access. This script does not have any relation to zencart, nor any includes from it, only a mysql query which updates a products description.

What is the most basic, but secure way to require the same admin login/flag/session as admin panel requires for any other page within it? What do I need to include for example to check if admin flag "isset"? I do not want to control it with .htacess, because I am browsing from different computer and internet IPs.

Thanks!

[swguy]

This script does not have any relation to zencart, nor any includes from it, only a mysql query which updates a products description.

Just use Zen Cart's built in production for admin pages. At the top of the file,

<?php
require 'includes/application_top.php';

This will ensure you are logged in before any further processing can be done.

[honatto]

Just use Zen Cart's built in production for admin pages. At the top of the file,

<?php
require 'includes/application_top.php';

This will ensure you are logged in before any further processing can be done.

Yeah, I thought so, too. The problem is I kind of struggle with "Admin Page Registration" tool. I have my .php script with name "generator.php" in a folder inside /admin/ and a CSS file in the same folder as well. Where do I have to place the .php file now?

I've created a corresponding language page name definition, for example "BOX_HEADING_THIRDPARTY" in both English and secondary language. I put the script "generator.php" in my admin folder. And filled the form as follows:
Page Key - ThirdPartyModule
Page Name - BOX_HEADING_THIRDPARTY
Page Filename - generator.php / generator (neither works)
Page Parameters - empty
Menu - picked the desired menu and marked display

And I get "The filename definition entered does not exist. Please check that it has been spelt correctly."
I am doing something wrong. Mainly because all articles and topics regarding "Admin Page Registration" are related to plugins and not third-party pages / scripts.

[mc12345678]

Although, note that the path for that "require" would need to take into account the current location of the file in relation to the includes folder... or to move this "script" to the root of the admin folder...

[honatto]

Although, note that the path for that "require" would need to take into account the current location of the file in relation to the includes folder... or to move this "script" to the root of the admin folder...

Thanks for the note, but I would not mess up that. That is common sense.

[swguy]

Yeah, I thought so, too. The problem is I kind of struggle with "Admin Page Registration" tool.

As long as you always run as a superuser, you can skip this step and just type in the name of the script in your browser's address bar.

[lat9]

Yeah, I thought so, too. The problem is I kind of struggle with "Admin Page Registration" tool. I have my .php script with name "generator.php" in a folder inside /admin/ and a CSS file in the same folder as well. Where do I have to place the .php file now?

I've created a corresponding language page name definition, for example "BOX_HEADING_THIRDPARTY" in both English and secondary language. I put the script "generator.php" in my admin folder. And filled the form as follows:
Page Key - ThirdPartyModule
Page Name - BOX_HEADING_THIRDPARTY
Page Filename - generator.php / generator (neither works)
Page Parameters - empty
Menu - picked the desired menu and marked display

And I get "The filename definition entered does not exist. Please check that it has been spelt correctly."
I am doing something wrong. Mainly because all articles and topics regarding "Admin Page Registration" are related to plugins and not third-party pages / scripts.

Assuming that the form is that displayed by the Admins::Admin Page Registration tool, you'll need to create a /includes/extra_datafiles/thirdpartymodule.php that contains two defines:

define('BOX_HEADING_THIRDPARTY', 'The text to display on the menu');
define('FILENAME_THIRDPARTY', 'generator'); 

Then you'll enter FILENAME_THIRDPARTY for the Page Filename and choose the Menu on which the tool's sub-menu-item is to be displayed.

[honatto]

Okay, I managed. Who would guess "Page Filename" would also be a language definition which was defined in main_dir/includes/filenames.php; And the definifition had to point to the file name without suffix. I didn't see that mentioned anywhere, but it worked. Now I am testing the 2nd part - admin login requirement;

[swguy]

This topic is dealt with in great detail in:
https://docs.zen-cart.com/dev/code/creating_menu/