Hey,

Well you can use AS to accomplish that. In as you can create 5 different roles (you can name them however you want) and then do exactly what you have described above by checking the role for currently authenticated user.

Regards,

Milos

Hey,

Ah, I’m sorry, I’ve just noticed that I somehow forgot to add that inside the documentation. So, to protect some website page, you just add the following PHP code at the very top of your PHP file for that page:

<?php

include 'ASEngine/AS.php';

if (! app('login')->isLoggedIn()) {
    redirect("login.php");
}

This code will prevent users that are not logged in to access the protected page and automatically redirect them to the login.php page if they are not logged in.

About disabling the registration, you will have to manually remove the HTML from that login page (login.php file) and then to remove the “registerUser” case from ASEngine/ASAjax.php file.

Regards,

Milos

Hey,

Well that’s not ideal solution because if that string never changes, it will be easy for someone to access the url if he figure out (or somehow see) the string. If you want to make it like that, then you probably should regenerate the string every time when someone use it. But again, keep in mind that it is not the best solution from security standpoint and that it’s better to ask users to log in with their username and password.

Regards,

Milos

thank you for your reply! In your opinion can I make the cookie never expire if I logon from another page? (not the domain.com/login.php page, but domain.com/login2.php)

Hey,

Well having never expire cookies is not the best idea from security standpoint, but it is one of possible solutions.

Btw, as you know, your support has expired so please extend the support if you have any questions.

Regards,

Milos

Hey,

Yeah, if source code is accessible only to you then that’s fine.

Regards,

Milos

Hey,

Well I’m not sure how your .php file looks like, but if you want the functions you have inside of it to be accessible inside all AS classes, just include it at the top of AS.php file.

Regards,

Milos

Hello,

This is the API I want to use https://github.com/BlockIo/block_io-php/blob/master/lib/block_io.php , basically what I want to do is that when a user register it’ll generate a new bitcoin address that will be associated with his account, I already have a “bitcoin_address” column in my as_users table, I did as you said I included the block_io.php in the top of AS.php and I did this edit in the register function in asregister.php :

$block_io = new BlockIo(APIKEY, PIN, VERSION);

$this->db->insert('as_users', array(
         "email"     => $user['email'],
         "username"  => strip_tags($user['username']),
         "password"  => $this->hashPassword($user['password']),
         "bitcoin_address" => $block_io->get_new_address(array('label' => 'test1')),
         "confirmed" => $confirmed,
         "confirmation_key" => $key,
         "register_date" => date("Y-m-d")
     ));

But when I try to register I’m getting an “undefined” error in the login page and the user is not added in the database, I don’t understand what did I do wrong, I’ll be very grateful if you could help me solve this issue.

Thanks.

Hey,

Well you should enable debug mode as it is explained inside the docs http://docs.as-php.com/developer-guide.html and fix the errors you are getting. It is related to BlockIo and how you integrated it into the app, so I cannot really help much in such situation. I believe that when you enable debug mode and see the actual errors you are getting it will help you to easily solve the problem.

Regards,

Milos

unfortunately I cannot update my webserver as my hosting provider hasn’t done that yet. the product was advertised with social login (which I need) and compatibility with php 5.3. if I can’t use the product I would like a refund so that I can find one that will fit my needs. kind regards, alex

Hey Alex,

Of course, you can request the refund here and I’ll be glad to approve it: https://codecanyon.net/refund_requests/new

Just a friendly advice, you should definitely consider changing the hosting provider since PHP 5.3 is getting really old and it is not supported and maintained for a while now.

Regards,

Milos

I know I know haha (I mean php 7 is out). I’ve been on their a** for a while about it. But I’ve got another year in my contract so nothing much I can do. I did like your script otherwise

Here’s some of the the error log (it’s really long, so and all there errors are the same, so here’s the end). Could my server have deleted a file?

[29-Jun-2017 15:09:12 UTC] PHP Warning: session_start(): open(/var/cpanel/php/sessions/ea-php70/sess_300a4c7f7f1beabed10bd7cf1c4bcff4, O_RDWR) failed: No such file or directory (2) in /home/goodcyte/public_html/fiendcollectors.com/ASEngine/ASSession.php on line 34 [29-Jun-2017 15:09:24 UTC] PHP Warning: session_start(): open(/var/cpanel/php/sessions/ea-php70/sess_300a4c7f7f1beabed10bd7cf1c4bcff4, O_RDWR) failed: No such file or directory (2) in /home/goodcyte/public_html/fiendcollectors.com/ASEngine/ASSession.php on line 34 [29-Jun-2017 15:16:53 UTC] PHP Warning: session_start(): open(/var/cpanel/php/sessions/ea-php70/sess_300a4c7f7f1beabed10bd7cf1c4bcff4, O_RDWR) failed: No such file or directory (2) in /home/goodcyte/public_html/fiendcollectors.com/ASEngine/ASSession.php on line 34 [29-Jun-2017 15:40:25 UTC] PHP Warning: session_start(): open(/var/cpanel/php/sessions/ea-php70/sess_300a4c7f7f1beabed10bd7cf1c4bcff4, O_RDWR) failed: No such file or directory (2) in /home/goodcyte/public_html/fiendcollectors.com/ASEngine/ASSession.php on line 34

OK, problem solved. The server updated the PHP to 7.0. Can AS be updated for 7.0/7.1 php?

Hey,

Sorry for a bit late response. I’m glad you solved the problem.

Well the latest AS version available on CodeCanyon is already working properly on PHP 7.0 (demo site runs on PHP 7.0) so you should not have any issues with it. It is not tested on PHP 7.1 but it should work perfectly fine there too.

This error from above clearly says that session cannot be started because the folder used for storing session files (which is set in php.ini file) does not exist. You should make sure that it uses some folder that exists on your system.

Regards,

Milos

Hey,

Thanks! Ok, I’m here to help. Lets see what can be a problem here.

You should set the Host to “localhost” if your database server is on your local server. If not, you should set it to where your database is located. If you are not sure about the db credentials, you should contact your GoDaddy support and they will let you know your exact database credentials.

From this error message you get it’s clear that your database credentials are correct. Either your host value is not correct or it is username/password.

Regards,

Milos

Thanks, I’ll look into that. What is “interesting” is that I get the exact same error even on my localhost (xampp on my C: drive). So it’s happening on any installation I’ve tried. I’m not supposed to create the MySQL database first, am I? I enter new usernames, passwords, and database names. Nothing works with always that error:

SQLSTATE[[HY000]] [[1045]] Access denied for user ‘name’@’localhost’ (using password: YES)

Hey,

That is really really strange. Do you have some other app that is using your database which you can use to test database connection? If not, here is an example PHP script that you can use to test database connection:

<?php
$hostname = "localhost";
$username = "your_username";
$password = "your_password";

try {
    $dbh = new PDO("mysql:host=$hostname;dbname=mysql", $username, $password);
    echo "Connected to database"; // check for connection
    }
catch(PDOException $e)
    {
    echo $e->getMessage();
    }

Create new php file and paste the content from above into it. After that just update those variables at the top with your username and password and access this php file from a browser. You should get “Connected to database” if PHP is able to connect to your db.

Let me know.

Regards,

Milos

Hey,

It looks like there is something wrong with your server configuration (probably files permissions). Can you make sure that install/check.php file is actually executable and that you can access it directly via following url: http://www.aspenresources.com.au/asprx/install/check.php?action=requirements

Let me know if it fixes the problem.

Regards,

Milos

Hey Brad,

Well you can add any page and just omit the logic which is checking if user is logged in. So, you include the “AS.php” file at the top of your page and then you can do things like

<?php if (app('login')->isLoggedIn()): ?>
    <p>this is visible to authenticated users only</p>
<?php else: ?>
    <p>this is visible to non-authenticated users only</p>
<?php endif; ?>

Regards,

Milos

ar dont worry I actually figured it out adding

if (self::isValidReferer()) {
    return true;
}

but I am interested which is the code that grabs the CSRF and valid it? isValidReferer() doesnt seems to be grabbing the CSRF code?

Hey,

I’m glad you figured it out.

At the bottom of AS.php file you will see how ASCsrf::validate() method is called when request type is POST. That’s where the validation happens.

Regards,

Milos

Hey,

Do you use ajax for submitting the forms or not? If you are using AJAX, then AS comes already configured to send CSRF token with each AJAX request. The only thing you need to do in that case is to include the following two javascript files before your javascript code:

<script src="assets/js/jquery.min.js"></script>
<script src="ASLibrary/js/js-bootstrap.php"></script>

However, if you are not using AJAX, then you will need to add CSRF token to each form you create so it can be properly sent to the server. Check my response here for more info: https://codecanyon.net/item/advanced-security-php-registerlogin-system/5282621/comments?filter=all&page=41#comment_16062833

Regards,

Milos

Hey, thanks for the reply.

Hey,

I’m sorry but I’m not sure that I understand your question, but if you are asking if you can use AS on your HTML website, then yeah, you can if your server supports the AS script itself. The only thing you need to do is to change the extension of your files from ”.html” to ”.php” and to add following php code at the very top of any page that you want to protect:

<?php

include 'ASEngine/AS.php';

if (! app('login')->isLoggedIn()) {
    redirect("login.php");
} 

Regards,

Milos

Hey,

There is no way to disable it completely, but you can set it to some high number (like 100 or 200 for example) which should still be there to protect you from brute force attacks, but it will allow much more “password failures”. This number is defined as LOGIN_MAX_LOGIN_ATTEMPTS constant inside ASEngine/ASConfig.php file.

Regards,

Milos

Hey,

Please check the demo: https://as-php.com/users.php

Regards,

Milos

Hey Karl,

The process you have described is correct, you can link to the AS login page and when use click on “Login” link he will be redirected to the login page. After he provides the username/password, he will be redirected to any other protected website page.

Now, to protect some website page, you just add the following PHP code at the very top of your PHP file for that page:

<?php

include 'ASEngine/AS.php';

if (! app('login')->isLoggedIn()) {
    redirect("login.php");
} 

This code will prevent users that are not logged in to access the protected page and automatically redirect them to the login page if they are not logged in.

I hope that I explained how the system works a bit more clearly now.

You should always check the demo to see the app in action: https://as-php.com/login.php

As you can see on item description page, demo credentials are:

username: admin password: admin123

Regards,

Milos

Hey Anders,

I’ve just replied to your email. Just turn the debug mode on and you should be able to easily debug it and see what is causing the issue.

Regards,

Milos

Hey,

Well Vanguard is completely different application, with completely different database and code structure. So it means that you will basically have to rewrite most parts of your application, and to force your users to reset their passwords when you complete the rewrite process and when you import your users from AS.

So basically, if you are familiar with Laravel and you want to rewrite your app, you will have to do everything manually, page by page, and once everything is ready you will need some small php script to import users from your current app.

Regards,

Milos