How to make sure a PHP script that handles an ajax request is not accessible to use and the user is authenticated?

Question

I have an jquery ajax request that calls a PHP script that will send an email. This email is happening from the admin, so a user must be authenticated in order to be able to do this. I've got two questions:

How can I lock this PHP file down from somebody being able to go directly to the path in the browser and keep submitting it?
How do I only run the file if the user is authenticated?

PHP:

$emailer = new GiftCardEmailer();
$emailer->SendGiftCardEmail($gift_card);

jQuery:

 $(document).ready(function() {                
     var status = $('p#status');
     status.hide();

     $('#sendemail').click(function() {                   
          $.ajax({
                    url: 'mail-handler.php',
                    beforeSend: function() {
                        status.fadeIn();
                        status.html('<img src="images/ajax-loader.gif" />');  
                    },                        
                    success: function( data ) {
                        if (console && console.log){
                            console.log( 'Sample of data:', data.slice(0,100) );
                        }                            
                        status.html('Email Sent Successfully.');   
                        setTimeout(function() {
                            status.fadeOut(); 
                        }, 4000);                            
                    }
                });
            });
        });

score 3 · Accepted Answer · edited May 23 '17 at 11:56

3

One approach would be to check for a valid session at the head of the file containing the actual mail code. If no session exists then simply terminate the script.

Check out ajax and security, might be helpful.

edited May 23 '17 at 11:56

Community

1
1

answered Dec 04 '11 at 01:54

Cyclonecode

29,115
11
72
93

1

+3 for being the only person who has even thought to check for an authenticated session, shame on the rest of you for your HORRENDOUSLY INSECURE referrer checking and 'is ajax' checking. It's not like their easy to spoof... – James Butler Dec 04 '11 at 02:37

score 1 · Answer 2 · answered Dec 04 '11 at 05:13

1

I do all of mine with session_start() at the top of a php page and then check for my specific session variables for authentication.

No session, no access.

answered Dec 04 '11 at 05:13

Higgsy

324
1
14

How to make sure a PHP script that handles an ajax request is not accessible to use and the user is authenticated?

2 Answers2