1

We have a Joomla site (latest version) with a page that links to another system with a fixed username/pw, so like https://www.othersystem.com/login.php?un=[fixed_un]&pw=[fixed_pw].

Now we need to change that link based on the Joomla user credentials with an email address. I.e. https://www.othersystem.com/[email protected]. This preprocess page will only accept calls from the Joomla page - and, as the user is already logged in there - will lookup the correct other-system credentials based on the email address and foprward the user to login.php with the found credentials.

I'm a Joomla no-Know. What I've found so far is that we need to add extensions like Sourcerer or add-custom-PHP to be able to write code in the link page. And maybe adding JDatabase to access the db, but once I'm in PHP I should be able to set up my own connection if needed. I'm sure Joomla will have a session variable which is the username. And that is exactly what I need to grab as it's the email I need to send out.

My questions: (1) will this approach work? (2) is there a smarter way? I can hardly imagine you can't build a link based on variables in Joomla, but I'm too newbie to know and/or to find (3) could you give me a nudge in the right direction on tackling this? I'm fluent in PHP and SQL and good enough in Javascript etc.

Thank's for any input, Bob

Improve this question
3
  • I am happy to see that you are no longer passing an unencrypted password via url querystring. So that your question is not Too Broad, perhaps have a go and let us know if you get stuck at a particular point. Asking for complete, multi-step tutorials using best practices often leads to a page stalling out or receiving vague/theoretical/low-value answers. See if you can rein your question in a bit and show the parts of your coding attempt that do work as required so that we don't tell you how to do things that you already know how to do.
    – mickmackusa
    Sep 17, 2019 at 23:54
  • Well actually we did it a little bit better. Joomla calls a PHP page which does the actual un/pw forward, so it's invisible to the user. But I thought this info would needlessly clutter the question.
    – Bob Mulder
    Sep 18, 2019 at 0:36
  • And what about the "man-in-the-middle" who intercepts the data en route without asking for your permission to do so and can freely grab the username & password. Again, happy you've refactored.
    – mickmackusa
    Sep 18, 2019 at 0:40

1 Answer 1

Reset to default
0

You seem to be on the right track.

Using the free or paid version of Sourcerer, you can build the link with the email address of the currently logged in user as follows:

{source}
<?php
  $user = JFactory::getUser();
  echo "<a href='http://www.othersystem.com/preprocess.php?em=" . $user->email . "'>Login</a>";
?>
{/source}

If there is no currently logged in user, a blank email will be passed and the login will fail although you might want to display an error message or only make the link visible to users logged in to Joomla already.

Improve this answer
1
  • Thanks Neil, this is great. I'm going to test tomorrow and post back. It's medical site with general emergency info, but to access their business info the doctors need to be logged in. So they won't see the link otherwise. And I'll reject any email I don't recognize, so including any blank ones. But that's a good one to display some error message for user feedback and ++ a counter on the site so I can see if this is an issue. Hadn't thought of that. The Joomla-users are the doctors who have access to other-system, and the registered emails SHOULD be the same, but what if....
    – Bob Mulder
    Sep 18, 2019 at 0:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.