Restrict admin area to IPs

[Thorsten Kohpeiß]

Hi,

how can I restrict the access to the admin area based on IP addresses?

Thanx.

Regards Thorsten

[Thomas von Deyen]

Yes, with some Apache or Nginx knowledge you can.

http://www.cyberciti.biz/faq/apache-restrict-access-based-on-ip-address-to-selected-directories/

http://www.cyberciti.biz/faq/linux-unix-nginx-access-control-howto/

Hope this helps

best

Thomas

[Thorsten Kohpeiß]

Forgot to mention: its hosted at heroku.

Regards Thorsten

[Thomas von Deyen]

Ok, then you need to patch the Alchemy::Admin::BaseController

Caution, Pseudo Code ;)

# config/initializers/secure_alchemy_backend.rb
Alchemy::Admin::BaseController.class_eval do
before_action {
if request.ip != '1.2.3.4'
return && redirect_to(root_url, message: 'You are not allowed to access this url')
end
}
end

Maybe you need `request.remote_ip`, don't know.

best

t

> --
> You received this message because you are subscribed to the Google Groups "Alchemy CMS" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to alchemy-cms...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Thorsten Kohpeiß]

Hi Thomas,

cool - this worked for me:

# lib/whitelist_constraint.rb

class WhitelistConstraint
  def initialize
    @ips = %w(127.0.0.* 192.168.0.*)
  end

  def matches?(request)
    @ips.select { |x| /#{x}/.match request.remote_ip }.length > 0
  end
end

# config/initializers/secure_alchemy_backend.rb

Alchemy::Admin::BaseController.class_eval do
  before_action {

    whitelist = WhitelistConstraint.new
    redirect_to(root_url, message: 'You are not allowed to access this url') unless whitelist.matches?(request)
  }
end

Regards, 

Thorsten

Am Donnerstag, 23. Oktober 2014 09:53:33 UTC+2 schrieb Thorsten Kohpeiß:

[Thomas von Deyen]

Wow, this is actually very PORO style \o/

nice

[Toby Johnson]

It seems like you could now accomplish this a bit more simply using the new `Alchemy.current_user_method` config setting instead, correct?

I'm planning to do something similar, where I don't want some logged-in users to even be able to view the admin area. So in that method, when Alchemy tries to get the current user, I'll redirect to root if it's not a user I want seeing that section.