0

I am creating a site that is ONLY for members, does every template have to be wrapped in a

{if logged_in} template {/if}
{if logged_out} {redirect='login'} {/if}

Is there a better and more flexible way? I will be having multiple member groups and I am using layouts, does that mean my if statement has to be in the wrapper template because whenever I do an "if" statement around the layout tag it does not work.

1 Answer 1

2

I have no idea what your actual setup is, but I general find that a best practice is to utilize embeds for control features as well as consistency. Here is an example: Two template groups, one call embeds, one called pages.

  1. Embeds
    1. index.html (unused)
    2. _header.html
    3. _footer.html
  2. Pages
    1. index.html
    2. random_template.html

Your pages template will all look like this:

{embed="embeds/_header"}

    Whatever you want in here, cochise.

{embed="embeds/_footer"}

and then your _header.html template looks like this:

{if logged_out && segment_1 != "login"}
    {if segment_1 == "account" && segment_2 == "password"}

        <!-- don't redirect, we're on a password reset request page -->

    {if:elseif segment_1 == "account" && segment_2 == "reset_password"}

        <!-- don't redirect, we're on a the actual page were you set a new password -->

    {if:else}

        <!-- not logged in and not trying to reset password -->
        {redirect="login"}
    {/if}
{/if}
<!DOCTYPE html>
<html language="en">
    <head>
    <!-- and so on -->

In this example, any user that is not logged in gets forced to the log in page, and it automatically will be processed on every page you embed your header on. I'm not familiar with layouts really so this may not apply perfectly. Also this example works for an application where registration is closed and users are manually registered by an admin; you could just add some extra conditionals to allow for a registration page.

3
  • Thank you, this is pretty much what I have I just didn't know how secure it was etc, or if it was the best way about it. I register members myself so that's fine, but I have multiple member groups which is a pain when you run into a unique scenario, where for example, a template is locked down to two specific member groups and then someone says well... we need a select few in a different member group to have temporary access to it also.... it means me having to temporarily hardcode those particular member ids into those templates. Is there a more flexible way to restrict access to templates? Jul 6, 2016 at 10:29
  • I solved a somewhat related problem using Zoo Visitor; it allows you to basically have a channel entry directly associated with each member. I then added custom fields to that channel that acted as permission flags. You could possibly do it natively with regular member fields.
    – jrothafer
    Jul 6, 2016 at 14:10
  • Do note that that last comment was a solution for my full time developer job; I did have to write a few custom add-ons to securely lock down access to channel entries (a government job requiring strict access control). The app is basically a locked down document storage system. For straight up page access permissions you shouldn't need to do that, but always carefully review security. Hope I'm helping somehow.
    – jrothafer
    Jul 6, 2016 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.