Sessions and file security... 1

[admoore]

I wish to authenticate client logons via sessions and display the contents of a specific directory to the user based on logon... So far, no problem... Script lists contents of appropriate directory and creates a link to access each file (.pdf reports)...

Here's my problem-

If I just use subdirectories within my public_html directory, a saavy user could access files via the path in the link anchor without authentication and perhaps guess their way into other users directories...

If I place the files somewhere other than public_html I can list the files; but, Apache won't/can't serve them upon demand.

I do not with to ask users to authenticate again using Apache & .htaccess so.... Any ideas???

PLUS...

Follow Up Question-

If I wish to addslashes to all post variables, how can I do that without calling each by name? I tried:

while (list($key,$val) = each($_POST))
{
    $_POST[$key] = addslashes($val);
}

But, this didn't work for me...

TIA for all!

 

[sleipnir214]

Perhaps let Apache deal with authentication at the filesystem level, and have PHP piggyback on the user-provided authentication credentials.

If you have a PHP script in a directory that is protected by Apache's authentication system using Basic authentication, the userid and the password provided to Apache will be available to PHP in the variables $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'], respectively.

______________________________________________________________________
TANSTAAFL!

 

[admoore]

Can I use PHP to pass authentication credentials to Apache so that once authenticated via sessions they could access a .htaccess protected directory?

If so, how?

TIA,

-ADM

 

[sleipnir214]

No way that I know of. ______________________________________________________________________
TANSTAAFL!

 

[rycamor]

There is one way to share authentication between PHP and Apache: mod_auth_mysql. This method stores authentication in a MySQL database, so that you can access that data by any other program, including PHP.

See these websites:

http://sourceforge.net/projects/modauthmysql

http://freshmeat.net/projects/mod_auth_mysql/

http://www.heuer.org/mod_auth_mysql/

Apparently, there are several mod_auth_mysql versions available, but the ones I list above seem the most recent. You can see them all by doing a search at

http://modules.apache.org

There is another method of sharing authentication, which is even more scaleable: LDAP. LDAP, or Lightweight Directory Access Protocol was created for exactly this kind of purpose: sharing authentication and user info between different hosts and environments. Do a search for "ldap" at

http://modules.apache.org

-------------------------------------------

Big Brother: "War is Peace" -- Big Business: "Trust is Suspicion"
(

http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html)