title: Codeigniter Restrict Admin Page via URL
body: <p>I am building a website wherein I have an admin and user page. I have a problem wherein I can access the admin page via URL even though I am logged in as a user. I have validation checks at the login page, however if I am already logged in as a user or as an admin, I can access all the pages. I want to restrict the pages to their roles only. Here's my code.</p>
  
  <p>MY_Controller:</p>
  
  <pre><code>function __construct()
  {
      parent::__construct();
      $this-&gt;is_logged_in();
  
      $session_admin = $this-&gt;session-&gt;userdata('isAdmin');
      $method = $this-&gt;router-&gt;fetch_method();
  
      if(($session_admin == FALSE) &amp;&amp; $method != 'login')
      {
        $this-&gt;session-&gt;set_flashdata( 'message', 'You need to login to access this location' );
        redirect('user_home');
      }
      else
      {
          redirect('admin_ticketing/new_tickets');
      }
  }
  
  function is_logged_in()
  {
      $is_logged_in = $this-&gt;session-&gt;userdata('is_logged_in');
  
      if(!isset($is_logged_in) || $is_logged_in != true) {
          redirect('login');
          die();
      }
  }
  </code></pre>
  
  <p>Model:</p>
  
  <pre><code>function validate()
  {
      $this-&gt;db-&gt;where('username', $this-&gt;input-&gt;post('username'));
      $this-&gt;db-&gt;where('password', $this-&gt;input-&gt;post('password'));
      $query = $this-&gt;db-&gt;get('accounts');
      $result = $query-&gt;row();
  
      if($query-&gt;num_rows() == 1)
      {
          return true;
      }
      else
      {
          return false;
      }
  }
  
  function check_role()
  {
      $this-&gt;db-&gt;where('username', $this-&gt;input-&gt;post('username'));
      $this-&gt;db-&gt;where('password', $this-&gt;input-&gt;post('password'));
      $this-&gt;db-&gt;where('role', 1);
      $query = $this-&gt;db-&gt;get('accounts');
      $result = $query-&gt;row();
  
      if($query-&gt;num_rows() == 1)
      {
           $data = array(
              'userid' =&gt; $result-&gt;userid,
              'username' =&gt; $result-&gt;username,
              'password' =&gt; $result-&gt;password,
              'firstname' =&gt; $result-&gt;firstname,
              'lastname' =&gt; $result-&gt;lastname,
              'email' =&gt; $result-&gt;email,
              'address' =&gt; $result-&gt;address,
              'monthly_dues' =&gt; $result-&gt;monthly_dues,
              'arrears' =&gt; $result-&gt;arrears,
              'isAdmin' =&gt; true,
              'contactnum' =&gt; $result-&gt;contactnum,
              'role' =&gt; $result-&gt;role,
              'is_logged_in' =&gt; true
          );
          $this-&gt;session-&gt;set_userdata($data);
          return true;
      }
      else
      {
          return false;
      }
  }
  
  function check_user()
  {
      $this-&gt;db-&gt;where('username', $this-&gt;input-&gt;post('username'));
      $this-&gt;db-&gt;where('password', $this-&gt;input-&gt;post('password'));
      $this-&gt;db-&gt;where('role', 0);
      $query = $this-&gt;db-&gt;get('accounts');
      $result = $query-&gt;row();
  
      if($query-&gt;num_rows() == 1)
      {
           $data = array(
              'userid' =&gt; $result-&gt;userid,
              'username' =&gt; $result-&gt;username,
              'password' =&gt; $result-&gt;password,
              'firstname' =&gt; $result-&gt;firstname,
              'lastname' =&gt; $result-&gt;lastname,
              'email' =&gt; $result-&gt;email,
              'address' =&gt; $result-&gt;address,
              'monthly_dues' =&gt; $result-&gt;monthly_dues,
              'arrears' =&gt; $result-&gt;arrears,
              'isAdmin' =&gt; false,
              'contactnum' =&gt; $result-&gt;contactnum,
              'role' =&gt; $result-&gt;role,
              'is_logged_in' =&gt; true
          );
          $this-&gt;session-&gt;set_userdata($data);
          return true;
      }
      else
      {
          return false;
      }
  }
  
  function check_active()
  {
      $this-&gt;db-&gt;where('username', $this-&gt;input-&gt;post('username'));
      $this-&gt;db-&gt;where('password', $this-&gt;input-&gt;post('password'));
      $this-&gt;db-&gt;where('isActive', 1);
      $query = $this-&gt;db-&gt;get('accounts');
      $result = $query-&gt;row();
  
      if($query-&gt;num_rows() == 1)
      {
          return true;
      }
      else
      {
          return false;
      }
  }
  </code></pre>
  
  <p>Controller:</p>
  
  <pre><code>function validate_login()
  {
      $this-&gt;load-&gt;model('model_accounts');
      $valid = $this-&gt;model_accounts-&gt;validate();
      $isAdmin = $this-&gt;model_accounts-&gt;check_role();
      $isUser = $this-&gt;model_accounts-&gt;check_user();
      $isActive = $this-&gt;model_accounts-&gt;check_active();
  
      if($valid &amp;&amp; $isAdmin &amp;&amp; $isActive) // Active Admin
      {
          redirect('admin_ticketing/new_tickets');
      }
      else if($valid &amp;&amp; $isActive &amp;&amp; $isUser)  // Active User
      {
          redirect('user_home');
      }
      else if(($valid &amp;&amp; $isAdmin) &amp;&amp; $isActive == false)  //Deactivated Admin
      {
          redirect('login/admindeact');
      }
      else if($valid &amp;&amp; ($isActive &amp;&amp; $isAdmin) == false) //Deactivated User
      {
          redirect('login/userdeact');
      }
      else if($valid == false) //Invalid Account
      {
          $data['message'] = "Sorry, the username and password you entered did not match our records. Please double-check and try again. ";
          $this-&gt;template-&gt;load('template', 'view_login', $data);
      }
  }
  </code></pre>