Auto Log IN

[southernmoney]

Latest Version.

Hi Klemen,

I need to prevent my staff from opening Hesk when the are at home to gaurd against data theft.

I tried to use the automatic log in setting with the idea to set our computers up myself and staff will then automatically be able to enter Hesk but at home they will not be able because they do not have the password.

However, I cannot get it to work. I did all I had to but it stores only the user name and not the password to allow automatic entry.

Am I doing something wrong?

Thanking you kindly.

Southern Money


[/list]

[Klemen]

Not sure what's wrong, but this could lead to many issues including you having to type in the password every time the cookie is deleted.

Maybe you should try a different approach - deny any access to your Hesk "admin" folder except from your local IP addresses (IP range). For example a simple .htaccess file inside the admin folder would do:

Code: Select all

AuthName "Admin area"
AuthType Basic 
<Limit GET POST>
order deny,allow
deny from all
allow from 199.166.210.
allow from .golden.net
allow from proxy.aol.com
allow from fish.wiretap.net
</Limit>

Some more possible examples here:
http://home.golden.net/htaccess.html

[southernmoney]

Hi Klemen,

I have no cooking clue what you are talking about. Smile...

If access is from my local IP address. Does that mean it is from my local for example dialup.

And will I then be able, as I do now to check their work flow from another town or will I be limited to that IP address too. If so it will not work for me.

I am not sure I understand the functioning.

Is there perhaps a way to see who of the ticket operators are online.

Best wishes.

Southern Money

[Klemen]

What I mean was - if you have a static IP at work (always the same IP address - you can request a static IP from your ISP), for example your IP at work always is: 111.222.333.444

Then you can create a plan text file called ".htaccess" and enter this inside:

Code: Select all

AuthName "Admin area" 
AuthType Basic 
<Limit GET POST> 
order deny,allow 
deny from all 
allow from 111.222.333.444
</Limit>

This way only people with IP 111.222.333.444 will be able to login to Hesk admin panel (only people from your office).


But if that's too much for you, we need to figure out why the password isn't remembered. Since the username is remembered we know that cookies work OK.

Try this:
1. login to HESK
2. don't click the "Logout" button, just close all browser windows
3. Open Hesk again, are you still logged in?

[southernmoney]

Hi Klemen,

I logged in, the closed all and when I visited the link again hesk was still active.

Regards

Southern Money

[Klemen]

OK, so it worky normally. Password isn't remembered only when someone clicks "Logout", so you only need to disable that function.

Edit file "show_admin_nav.inc.php" inside "inc" folder and delete

Code: Select all

<td><a href="index.php?a=logout"><img src="../img/ico_logout.gif" width="26" height="26" border="0" alt="<?php echo $hesklang['logout']; ?>" title="<?php echo $hesklang['logout']; ?>" /><br /><?php echo $hesklang['logout']; ?></a><br /><img src="../img/blank.gif" width="50" height="1" alt="" /></td>

[southernmoney]

Hi Klemen,

You know me by now. Smile... always scared I will make a mistake.

This is a simple delete is it? I cannot afford to go down time. Just want to make sure. There is not perhaps something else I have to do and what will the effect or gain be?

Sorry for asking, but need to understand.

Thanking you kindly.

Southern Money

[Klemen]

Just delete, yes.

Don't be so scared, just make sure:
1. make BACKUP before doing it
2. make changes in low-traffic hours (during weekend, early in the morning, ...)
3. test everything after the change

If anything goes wrong you can simply upload the backup file...

[southernmoney]

Hi Klemen,

Thanks for that assurance.

I did as you indicated.

It worked 100%.

However, it removed the logout icon form the ticketing software. Does this mean that one cannot disconnect form the database or that the connection remains active on the internet untill I connect again. Can it compromise security in any way.

Thank you for your assistance. I am sure others are also interested. Perhpas this can be addressed in the new version.

Best wishes.

Southern Money

[Klemen]

That was the idea - if you want to keep people logged in you need to disable the "logout" button.

This will have no effect on the database or connections as all PHP database connections stop the moment the page displays in the browser.

[southernmoney]

Hi Klemen,

I understand. It works perfectly albeit that it feels strange not being able to click on a log out button when one exit.

This is of great assistance to prevent staff form entering a database form their home and so buse the contacts in the database for their own benefit. As a jurist I think it is extremly important that business owners should be vigilant to this problem. Your solution certainly addresses it.

Thanking you kindly

Southern Money