Is my “hidden” page secured?

Question

I want to create a page which someone can view only if he is registered and granted access to.

For granting access to a user for i use a row in the #__users table named activated2.

So i created a view file inside a component and my view.html.php file is like that:

class IpropertyViewVtourpaketa extends JView
{
  function display($tpl = null)
  {   
                 $user = JFactory::getUser();

                 if (!$user) {

                  header('Location:index.php?msgvtour=You need to register and get activated');

                }
                else {
                 $db= JFactory::getDBO();
                 $query='SELECT activated2 from `#__users` where id='.$user->id;

                 $db->setQuery($query);
                 $pro=$db->loadResult();

                 if ($pro==0) {

                     header('Location: index.php?msgvtour=You need to get activated');
                 }else {

                // Display the view
                parent::display($tpl);
              }
            }
        }
}
?>

So what im doing is : check if he is registered, if not redirect him . Then check if he is activated, If not redirect him. Else redirect to the view where he can see the page. This is working really nice altough what i wanted to know is:

How safe is this way i use? Could this be easily hacked or bypassed?

Answer 1

There are some things I would change:

• You should not put your database queries in this file. Joomla uses MVC, therefore your queries should be put in a function, in the model.
• Don't use PHP's default header() function. Instead make full use of the Joomla API for redirecting
• Rather than adding your own column (activated2) to the #__users table which is a bad idea, I'd suggest you make full use of Joomla's ACL Management for your component.
• For the database query, I'd suggest using Joomla's methods rather than writing it in plain SQL. Here here for more information

Hope this helps

Answer 2

No, your code is not right.

• JFactory::getUser() always returns a user object. If user is a guest, $user->id == 0 or better ($user->guest)
• In #__users table, there is no user id 0
• index.php?msgvtour does not seem to belong to Joomla world
• Instead of "header('Location:...", it is better to work with Joomla API (check )

For example, from components/com_users/views/profile/view.html.php:

/**
 * Execute and display a template script.
 *
 * @param   string  $tpl  The name of the template file to parse; automatically searches through the template paths.
 *
 * @return  mixed   A string if successful, otherwise a Error object.
 *
 * @since   1.6
 */
public function display($tpl = null)
{
    ....
    // View also takes responsibility for checking if the user logged in with remember me.
    $user = JFactory::getUser();
    $cookieLogin = $user->get('cookieLogin');

    if (!empty($cookieLogin))
    {
        // If so, the user must login to edit the password and other data.
        // What should happen here? Should we force a logout which destroys the cookies?
        $app = JFactory::getApplication();
        $app->enqueueMessage(JText::_('JGLOBAL_REMEMBER_MUST_LOGIN'), 'message');
        $app->redirect(JRoute::_('index.php?option=com_users&view=login', false));

        return false;
    }

    ....

    return parent::display($tpl);
}