Re: lug-bg: PHP + Password Authorization
- Subject: Re: lug-bg: PHP + Password Authorization
- From: luben@xxxxxxxxxxxxx (luben karavelov)
- Date: Mon, 30 Oct 2000 21:34:55 +0200
EDAC wrote:
>
> > Ako ti trqbwa da prawish autorizaciq na nqkakwa
> > stranica to move da hwanesh i da minesh prez modula na
> > HTTPd servera. Kato toj shte ti izkara prozorche za
> > autorizaciq, sled koeto shte ti wyrne parolata i imeto
> > w promenliwi $PHP_AUTH_USER i $PHP_AUTH_PW. Eto ti
> > towa kato primer :<?php
> > if(!isset($PHP_AUTH_USER)) {
> > Header("WWW-Authenticate: Basic realm=\"My
> > Realm\"");
> > Header("HTTP/1.0 401 Unauthorized");
> > echo "Text to send if user hits Cancel button\n";
> > exit;
> > } else {
> > echo "Hello $PHP_AUTH_USER.<P>";
> > echo "You entered $PHP_AUTH_PW as your
> > password.<P>";
> > }
> > ?>
> > kato imash na predwid che internet explodera e
> > pretenciozen kym zaglawnata chast. Po syshtiqt nachin
> > movesh da go polzwash za da prowerish i kym nqkoq baza
> > danni ili drugi mesta.
> Da tova mi e jasno. Vyprosa mi beshe kak da proveria dali vyprosnite
> PHP_AUTH_USER i PHP_AUTH_PW sa validni login/password za
> samata Linux mashina, na kojato se startira scripta.
ami php-to se run-va kato modul na apache-a => kato user nobody i grupa
nogroup ili zavisi ot distroto, pri men sa www-data. kato takav user, toi
niama prava da chete /etc/shadow. tova shte reche che direktno ne mozhe.
mozhesh da si napishesh programka, koiato check-va user-a i parolata,
da ia compilirash i da ia setuid-nesh (chmod +x filename) i da ia polzvash
chrez exec() v php-to.
moia savet e da ne se muchish da pishesh otnachalo takava programa, shtoto
dopusnatite greshki sa principna vuzmozhnost sa root access na server-a ti.
po-skoro modificirai minimalno niakoia veche napisana takava, naprimer
"checkpassword" ot qmail ili kakvoto predpochitash
uspeh
Luben
==================================================================
A mail-list of Linux Users Group - Bulgaria (bulgarian linuxers)
Otpiswaneto RABOTI !!! : Majordomo@xxxxxxxxxxxxxxxxxx UNSUBSCRIBE LUG-BG
http://www.linux-bulgaria.org/ Hosted by Internet Group Ltd. - Stara Zagora
|