Re: doc web efforts update
| From: | Nuno Lopes | Date: | Thu, 10 Jun 2004 10:35:51 +0000 |
| Subject: | Re: doc web efforts update | ||
| References: | 1 2 3 4 5 | Groups: | php.doc.web |
| Request: | Send a blank email to doc-web+get-22@lists.php.net to get a copy of this message | ||
> Why do you need all this ? Just ask them to login from master.php.net,
they will
> have the magic cookie enabled and we won't need any pasword. What am I
missing ?
>
> didou
Then you have to check if the password on the cookie is valid!
--------------------
This is the code to set the cookie on the master server
// Set magic cookie if login information is available
if (isset($_POST['save']) && isset($_POST['user']) &&
isset($_POST['pw'])) {
setcookie(
"MAGIC_COOKIE",
base64_encode("{$_POST['user']}:{$_POST['pw']}"),
time()+3600*24*12,
'/',
'.php.net'
);
list($user, $pw) = array($_POST['user'], $_POST['pw']);
}
-----------------
so, someone might set a cookie with the value of
base64_encode("didou:bogus_pass") and login sucessfully as you!
We surely need to check the password in the cookie!
Nuno