authorization in codeigniter - php

Question

I'm working with codeigniter, I'm doing an auth system - user can log in, he can see all pages, after he can log out. The problem is next: why logged out user can see all pages without to be logged in. how can I correct it? This is my controller:
<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
class User extends CI_Controller {
public function __construct() {
parent::__construct();
$this->load->helper(array('url', 'form'));
$this->load->model("usermodel");
$this->load->library('session');
}
private function view($page, $data=false) {
if($page == "auth/login" ){
$this->load->view("auth/header_auth.php");
}else{
$this->load->view("header.php");
}
$this->load->view($page, $data);
$this->load->view("footer.php");
}
public function index() {
if ($this->session->userdata("user")) {
redirect("dashboard", "refresh");
return;
}
$this->view("auth/login");
}
public function fail() {
$this->view("auth/login");
}
public function dashboard() {
$this->view("auth/dashboard");
}
public function login() {
$login = $this->input->post("login");
$password = $this->input->post("password");
if ($this->usermodel->login($login, $password)) {
$this->session->set_userdata("user", $login);
redirect("dashboard", "refresh");
} else {
redirect("fail", "refresh");
}
}
public function logout() {
$this->session->unset_userdata('user');
session_destroy();
redirect('index', 'refresh');
}
}

Answer 1

you must check if user is logged in at beginning of each function which must have user privileges to view
if (!$this->session->userdata("user")) {
redirect("auth/login", "refresh");
}
I am assuming that your view function can only be viewed if a user is logged in, change
private function view($page, $data=false) {
if($page == "auth/login" ){
$this->load->view("auth/header_auth.php");
}else{
$this->load->view("header.php");
}
$this->load->view($page, $data);
$this->load->view("footer.php");
}
to this
private function view($page, $data=false) {
if (!$this->session->userdata("user")) {
redirect("auth/login", "refresh");
}
if($page == "auth/login" ){
$this->load->view("auth/header_auth.php");
}else{
$this->load->view("header.php");
}
$this->load->view($page, $data);
$this->load->view("footer.php");
}
Update
also your dashboard can be viewed by everyone, to make it viewable only by logged in user do this:
public function dashboard() {
if (!$this->session->userdata("user")) {
redirect("auth/login", "refresh");
}
$this->view("auth/dashboard");
}