I want to create a page which someone can view only if he is registered and granted access to.
For granting access to a user for i use a row in the #__users table named activated2
.
So i created a view file inside a component and my view.html.php
file is like that:
class IpropertyViewVtourpaketa extends JView
{
function display($tpl = null)
{
$user = JFactory::getUser();
if (!$user) {
header('Location:index.php?msgvtour=You need to register and get activated');
}
else {
$db= JFactory::getDBO();
$query='SELECT activated2 from `#__users` where id='.$user->id;
$db->setQuery($query);
$pro=$db->loadResult();
if ($pro==0) {
header('Location: index.php?msgvtour=You need to get activated');
}else {
// Display the view
parent::display($tpl);
}
}
}
}
?>
So what im doing is : check if he is registered, if not redirect him . Then check if he is activated, If not redirect him. Else redirect to the view where he can see the page. This is working really nice altough what i wanted to know is:
How safe is this way i use? Could this be easily hacked or bypassed?