1

On 2.5.5 I had a link like this on the client's product pages: http://cl.ly/image/2c3G3m1X0a3D

Very simple, if they are logged into the CP on another tab, they click the edit link and it opens this product's CP edit page in a new tab. The link looks like this: http://www.domain.com/admin/index.php?D=cp&C=content_publish&M=entry_form&channel_id=12&entry_id=7832

Worked great for years. Note also that the link is only shown if all these are true, so we know they are logged into a current CP session and have the right to see the link:

    $is_admin = TRUE;

    if($this->EE->session->userdata('group_id') != '1' AND $this->EE->session->userdata('group_id') != '6') {
        $is_admin = FALSE;
    }

    if($this->EE->session->userdata('access_cp') != 'y') {
        $is_admin = FALSE;
    }

    if($this->EE->session->userdata('admin_sess') != 1) {
        $is_admin = FALSE;
    }

I updated them to 2.7.3 and now those same links bring up just the CP login page. What has changed in the session/security model that would prevent this from working?

1 Answer 1

1

I believe what changed is that EE now defaults to requiring session IDs in the control panel URLs. (That's the S=e8a181fc77af1b35e47193c0e0b27a15 part you see.)

You can disable this at Admin -> Security and Privacy -> Security and Sessions, changing the Control Panel session type to Cookies Only.

Or, you can just add the session ID into your URLs, which is available in templates as {cp_session_id}

1
  • 1
    Thanks Jeremy - that pointed me in the right direction. I'm actually building this link inside of a plugin, so {cp_session_id} wasn't available for me in this case, but that is the right info. I looked at the session info for my front end tab and while my EE session_id was different than the session_id for my other tab, there was a session var called fingerprint that contained the same session_id, so $this->EE->session->userdata('fingerprint') did it for me. Feb 12, 2014 at 23:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.