Access admin as super administrator

Using the PowerCMS security as a starting point, I am adding a little bit of further complexity to my site.

I have modified the users_login.php page to take the user data from a members table and added a couple of new session variables to allow for the new user levels I have created.
(I have left the super administrator logic in place, and the wa_users table is still accessed for this role).

It all seems to be working OK, except when trying to log in as a super Administrator, and I can’t figure out how super administrator accesses the admin_cms home page.

The original admin_cms/index.php page has the following rule
<?php /*
if (!WA_Auth_RulePasses("Administrator")){
WA_Auth_RestrictAccess("users_login.php");
}*/
?>

but super administrators can still access the page, even though they are not in the administrators group.

In order to allow for my additional userlevels, I created a new group called All Admin Groups which allow access to the admin home page if the userlevel is either 1 or 2. (multi group administrator or administrator)

This seems to work OK, but I cannot access the page as a super administrator using this rule

on the admin_cms login page, there is the following code:

<?php

if(isset($_SESSION['UserGroupID']) && $_SESSION['UserGroupID'] == 1) {

    $_SESSION['AdminLogin'] = $GLOBALS['WAGLOBAL_Admin_Password'];

}

?>

<?php

if (!session_id()) session_start();

if((((isset($_POST["userName"]) && $_POST["userName"]== $WAGLOBAL_Admin_Username)?$_POST["userName"]:"") != ""))     {

  $_SESSION["AdminLogin"] = "".((isset($_POST["Password"]))?$_POST["Password"]:"")  ."";

    $_SESSION["SuperAdminLogin"] = "".((isset($_POST["Password"]))?$_POST["Password"]:"")  ."";

}

?>

this sets the AdminLogin and SuperAdminLogin if the supper admin is logging in. The supper admin doesn't get a UserGroupID though.

you can edit that to force the UserGroupID to 1 if the supper admin is logging in:

<?php

if (!session_id()) session_start();

if((((isset($_POST["userName"]) && $_POST["userName"]== $WAGLOBAL_Admin_Username)?$_POST["userName"]:"") != ""))     {

  $_SESSION["AdminLogin"] = "".((isset($_POST["Password"]))?$_POST["Password"]:"")  ."";

  $_SESSION["SuperAdminLogin"] = "".((isset($_POST["Password"]))?$_POST["Password"]:"")  ."";

  $_SESSION['UserGroupID'] = "1";

}

?>

Great, that seems to work.

I still don't quite understand why super admin gets access to the index page when it isn't in the administrators group though !

because the AdminLogin session gets set on Super Admin login.

Since the AdminLogin session is set, the super admin is a member of both the Admin and Super Admin groups.