PHP - Restrict access to admin page for logged on user - php

Question

I have a table in my database for users, each user has an auth_level (1-3). On my site I have a admin page for adding/deleting new user accounts, I want to restrict access to this page only to users that have an auth level of 3.
I have been trying to get this to work with sessions but I am stuck. Hoping someone can help me out.
Here is my code for restricting access. Not sure where I have gone wrong.
the check.php start the session.
<?php
require_once('check.php');
//This function returns True if auth level = '3'
//Otherwise it returns False
function CheckAccess()
{
$result = (isset($_SESSION['SESS_AUTH_LEVEL']) && $_SESSION['SESS_AUTH_LEVEL'] == 3 );
if(!$result)
{
header('WWW-Authenticate: Basic realm=“Test restricted area”');
header('HTTP/1.0 401 Unauthorized');
return false;
}
else
{
header("location: admin.php");
}
}
?>
If I log in as a user with auth level 1 or 3, I get the same blank page.

Answer 1

I think you never call CheckAccess(). Calling it maybe fixes your error.

Answer 2

It's perfectly valid to do the following, which your function is doing.
if (this=that) { /*do multiple*/ } else //do single;
However, it appears you are not calling this function? Try this:
<?php
require_once('check.php');
CheckAccess();
?>

Answer 3

You are missing the closing } of your function so all the if statement is seen as part of the method by PHP.
Add a } after $result = and before if
A slightly alternative version that should achieve what you want would be
<?php
function CheckAccess() {
$result = (isset($_SESSION['SESS_AUTH_LEVEL']) && $_SESSION['SESS_AUTH_LEVEL'] == 3 );
return $result;
}
if (CheckAccess()) {
header("location: admin.php");
} else {
header('WWW-Authenticate: Basic realm=“Test restricted area”');
header('HTTP/1.0 401 Unauthorized');
}

Answer 4

The problem is that there is already output before the headers are send:
this need to be changed
<?php
require_once('check.php');
?>
<?php
//This function returns True if auth level = '3'
//Otherwise it returns False
function CheckAccess()
{
...
to this
<?php
require_once('check.php');
//This function returns True if auth level = '3'
//Otherwise it returns False
function CheckAccess()
{
...
because the headers needs to be sent first then the content :)