php_auth_pw cgi problems 2

[cLFlaVA]

hi all. i have a site with an admin section i created. the admin section used php_auth_pw and php_auth_user to allow myself entry after entering my name and password.

i have recently upgraded my hosting plan, however. suddenly, i couldn't get on my admin section. so i emailed support, and they said they're running apache as a cgi, in "high security" mode. this, they said, is why i can no longer user php_auth_*.

what is the best method you think i should use to implement the same level of security i had, with this new environment?

thanks for your time and help,

cory

*cLFlaVA
----------------------------
[tt]I already made like infinity of those at scout camp...[/tt]
[URL unfurl="true"]http://www.coryarthus.com/[/url]

 

[DRJ478]

I suppose they meant that they run Apache and the PHP install in CGI mode, not as an Apache module.
Have you checked what the $_SERVER variables look like after the upgrade while in a restricted area?
I assume that the .htaccess restrictions still work?

 

[DRJ478]

Actually - the 'high security' mode is bogus. The fact is just that the PHP_AUTH_USER is not availabe via CGI.

The HTTP Authentication hooks in PHP are only available when it is running as an Apache module and is hence not available in the CGI version.

 

[sleipnir214]

To the best of my knowledge, there isn't one. The PHP online manual is pretty clear that $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] are available only when PHP is run under Apache (and under IIS with PHP5 running as an ISAPI filter) as a module (

http://www.php.net/manual/en/reserved.variables.php.

The PHP online manual section titled, "HTTP Authentication with PHP" (

http://www.php.net/manual/en/features.http-auth.php)

states that PHP has to latch onto hooks in the web server to get those variables at all.

You might try instead implementing your own HTML form-based authentication.

Want the best answers? Ask the best questions!

TANSTAAFL!!

 

[cLFlaVA]

sorry DRJ478, that's what I meant. PHP running as a CGI. I get confused with all these acronyms.

sleipnir, yeah that's what I figured - i'll set up a user authentication form.

thanks to both of you for your help.

- cory

*cLFlaVA
----------------------------
[tt]I already made like infinity of those at scout camp...[/tt]
[URL unfurl="true"]http://www.coryarthus.com/[/url]