[php] locking down intranet pages

[MK-2]

This kind of follows on from my previous thread about making certain pages visible to certain groups.

How it stands is I have index.php which contains a function to check the users group membership. it then users "require staff.php" etc to include the rest of the layout for that group. using require means that index.php stays at the top all the time so kids wouldn't get an idea to try staff.php.

i've also set a variable called $indexcalled on index.php so when it loads staff.php it checks that and dies if not set. so that way kids typing in staff.php wont have the variable set so cant see it.

 

this all works fine (so wont be changing any of that unless 100% needed) but the problem is the admin page. i wanted a page for the admins that has a link to all the other intranet pages (should we make changes and want to see what its like without having to authenticate as a kid). this page uses onclick to load the relevant page, but it then shows staff.php in the address bar. i need to use onclick but am having trouble locking it all down.

 

basically, as an admin i want the admin page to show links to the other pages i specify, but not show it in the address bar, so it stays as index.php. is this even possible, without having to use something like sessions (its only intranet so security isn't the highest priority here). i know it could be done with require/include, but again, it needs to incorporate onclick.

 

if none of this makes sense to anyone i can post up the php/html too

[MK-2]

managed to sort it, as its only intranet i just set a cookie on the admin page that is read by the other pages to see if user is admin.