hiding files with php - php

Question

I can't wrap my head around this, and it is SO frustrating. I have no idea how I'd be solving my problem.
I use sockets to connect with my NodeJS server, and I use PHP for routing people to the correct pages. When I route someone to the admin page I check if he is allowed to continue, if so I'll redirect him, if not I won't. Now here's the issue, people can just go to mywebsite.com/browser/admin.html and read everything that's in the admin panel (just the layout and stuff). I don't want people to be able and visit my admin panel to see what admins can do and can't do.
Can I do this in any way? E.g. only show the admin panel if they have a certain rank; if they don't have that rank they WILL NEVER be able to visit the admin panel. I'd like to hide the html files and other files somehow.
Routing - .htaccess
RewriteEngine on
RewriteRule ^/browser/admin.html$ index.php?page=admin [L,NC,QSA]
RewriteCond %{DOCUMENT_ROOT} !-f
RewriteRule ^(\w+)$ index.php?page=$1 [L,NC,QSA]
RewriteRule ^(\w+)+\/$ index.php?page=$1 [L,NC,QSA]
Routing - index.php
function route(){
global $db;
global $user;
$page = $_GET['page'];
if(!isset($page)) {
header('Location: /home');
}
if($page === 'home'){
loadWebpage('index.html', array());
}else if($page === 'admin'){
if($user['rank'] !== 'admin'){ /* This works but people can still access the files since they are loaded on the frontend with myexample.com/browser/admin.html */
echo 'Access denied.';
return;
}
loadWebpage('admin.html', array())
}
}
route();
I'm sorry if I haven't explained it well, but I hope you understand what I mean; I find it difficult to explain the things I want. I appreciate the help.

Answer 1

I believe there are plenty of ways to go about what you're trying to achieve, but I'll just explain one way of "access-protecting" a certain file.
Create a file in your directory, admin.php. Here, just have some basic code like this:
<?php
$accessKey = $_POST['accessKey'];
if ($accessKey == "MyVeryAwesomeAccessKeyThatNobodyKnows") //Change this to whatever you want
{
?>
<b>This info will only be shown if you're an admin!</b>
<?php
}
else
echo("Invalid access key.<br>");
?>
This code basically checks if the correct access key was sent in, and only if it was, will it load your protected file.
And then, wherever you have to access the admin page, you can put a form or something there like this:
<form method="POST" action="admin.php">
<input name="accessKey" type="password" />
<input type="submit" value="Load Admin Site" />
</form>
The user has to enter in the administrator access key to be granted permission into the protected information page. This way is a bit hackish, but it gets the job done!