php & htaccess

[deemarcus]

Hi, does anyone know if it is possible to set an htaccess file for a directory with a username and password and get a php page to set the username and password?

Hope this sakes any scence!

Kindest thanks,

Dee

 

[Olavxxx]

There are scripts out there, which compare user input with mysql db, if that's what your after.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[deemarcus]

Thanks for replying (hope your feeling better!).

I am already using a mysql database to log in which works fine, but i have files that someone could browse to on the website - so i thought if i can set an htaccss up for the directory and pass a username / password to it once the user logs in. I would just need one username / password in the htaccess file. When the userlogs in i would just set $_SERVER[PHP_AUTH_USER] & $_SERVER[PHP_AUTH_PW]

i hope!

Need to have a play.

Thanks for your help desturday btw, i sorted out the directory issue.

Regards.

 

[Olavxxx]

Google found this for me:

http://www.yetanothercommunitysystem.com/yacs/articles/print.php/314

I didnt try it, but I guess it would work.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[Olavxxx]

Also, the manual has some nice samples of auth:

http://no2.php.net/features.http-auth

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[deemarcus]

Still a bit stuck. this is what i want to do...

At the top of the php page it sets the username and password...

<?php

($_SERVER["PHP_AUTH_USER"] == "dee");
($_SERVER["PHP_AUTH_PW"] == "marcus");
?>

So rather than popping up the logon dialog it uses the values already set in the php page.

Regards.

 

[Olavxxx]

yeah, but cant you simply "escape" the login box, IF USER IS LOGGED IN?

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[deemarcus]

Hmmm, i just need to use a test page to set the username and password that matches what is in the .htpasswd file, if it is the same i should be able to browse to a protected folder else i should get a popup to login. Will see if i can put a page together, bit new to all this so it may take some time!

regards.

 

[Olavxxx]

cant you use this code:

<?php

function auth_user() {
   $realm = mt_rand( 1, 1000000000 );
   header('[URL unfurl="true"]WWW-Authenticate:[/URL] Basic realm="Realm ID='.$realm.']"');
   header('HTTP/1.0 401 Unauthorized');
   die("Unauthorized access forbidden!");
}

if (!isset($_SERVER['PHP_AUTH_USER'])) {
   auth_user();
} else if (!isset($_SERVER['PHP_AUTH_PW'])) {
   auth_user();
} else if ($_SERVER['PHP_AUTH_USER'] != $auser || $_SERVER['PHP_AUTH_PW'] != $apass) {
   auth_user();
} else if (isset($_GET['action']) && $_GET['action'] == "logout") {
   auth_user();
}

// Normal Page Code Here
?>

ps. I took it from a code-sample on php.net

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[deemarcus]

I think im getting confused! Think i best explain in detail what i am trying to do as i think i may be misleading you...


I have a directory called files which is protected by an .htaccess file.

page 1 (login.php)

the user logs in with a username and password which a validate.php page if an entry in an mysql database matches the username and password then a page called success.php is loaded else login.php is loaded.

the login.php page loads
sucess.php has links to files that are within the secured diredctory. i want to be able to open/download/view them by selecting hyperlinks. But i am propted to enter the usernname / password for .htacess

What i want to to is when the user logs in sucessfully (with the validate.php page) i want to also allow access to the secured folder by hardcoding a username and password that is in the .htpasswrd file.

If a user tries to open a file directly it will prompt for the username and password in the .htpasswrd file.


Hope this makes more scence?!!!!

kindest regards.

 

[Olavxxx]

it should be possible to encode64 the password and username and send it thru the URL.

How secure it is, is another matter though..
I dont have any examples of this flying around, as I never did it myself, but I read the technical specifications of htaccess, that it is possible.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[Olavxxx]

When you try to access a site which has been protected by .htaccess your browser will pop up a standard username/password dialog box. If you don't like this, there are certain scripts available which allow you to embed a username/password box in a website to do the authentication. You can also send the username and password (unencrypted) in the URL as follows:

http://username:password@www.domain.tld/directory/

however, base64 encoding should be possible, I think.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[Olavxxx]

Read up on this too:

http://httpd.apache.org/docs/2.0/howto/htaccess.html#when

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[deemarcus]

Hmmm, it works if i pass the usernameassword@ in the header to the link. But this is visible and people could save it as a favorite. need to see if i can set it in the php page. dont think it will be possible though...

 

[deemarcus]

Looks like it isn't going to be possible. Will see if i can bypass the login or somthing instead and only display it if someone tried to access the file directly...

Or rather than using a hyper link to get the file, i request the file instead and do the download atomatically (as i can browse a folder / subfolder and list files without actually logging on with the .htaccess password....

Does anyone know if this is possible?
maybee i should post this as a new thread?

regards...