URGENT! Problem with user authentication

I have recently purchased DataBridge and have created a site with a login page that then configures the users access based on their permissions (I have 3 different levels). This all works fine if you login and navigate to the pages. However if you know the url of a page and navigate to it directly you are able to gain access without logging in??? The user should be taken to the failed.php page. I obviously don't want to put the URL of the site on here as it would make it vunerable.

This is very urgent as there is sensitive information on the site.

Thanks

Hi Richard

You say you've used Data Brdige to create the login pages.

Did you run the wizard "Security Assist --> Manage Site Access --> Access Pages Manager" from the Dreamweaver "Webassist" menu?

Did you check the "Remember my information" and/or "Log me in automatically" checkboxes on the login page?

Yes that is correct, no I removed the options to automatically login and remember me. The only field surfaced are email and password.

I have also delete my cache, removed cookies and session cookies. As well as testing on different machines

Originally Said By: richard402207

  Yes that is correct, no I removed the options to automatically login and remember me. The only field surfaced are email and password.  

o.k., but did you also run the wizard, I mentioned above, to protect your admin pages?

Yes, I have also reviewed them using the pages manager and removed then re-applied them to see if that resolved the issue and I get nothing.

Hi

You've posted your issue in the "User Registration Solution Pack"-Forum, so that's why I asked if you were using Data Bridge, as there might be a difference.

However, I've never used the "User Reg. Sol. Pack". So, there could be a different approach for this WA product.
I've found this link:

ursp_restricting_access.pdf

Maybe this helps you a bit.

P.S.: With Data Bridge I've never run into such an issue, except when checking the "log me in automatically" checkbox. Of course that wouldn't be a problem with the extension, but my own error, just forgetting about the cookies to log in automatically...

Did you add the Access rule to protect the page?

Go to WebAssist -> Security Assist -> Mage Site Access -> Access Pages Manager. in the access pages manager, you can select the pages to protect and apply access rules.

if you have already applied the access rule to the page, what access rule are you using, and how was it defined?

Hi Jason,

Yes that is how I applied the rules. Please see the attached for more info.

so your admin rule is using a Group as the comparison.


double check in the Admin group that you have not accidentally add an empty value.

Open the access groups manager to edit the Admin Group. try to click in the empty space at the bottom of the group participant list to make sure there is no an empty member of the group.