Re: doc web efforts update
| From: | Jacques | Date: | Thu, 10 Jun 2004 21:20:38 +0000 |
| Subject: | Re: doc web efforts update | ||
| References: | 1 2 3 4 5 6 | Groups: | php.doc.web |
| Request: | Send a blank email to doc-web+get-28@lists.php.net to get a copy of this message | ||
On Thu Jun 10 11:35:51 2004 Nuno Lopes wrote:
> so, someone might set a cookie with the value of
> base64_encode("didou:bogus_pass") and login sucessfully as you!
> We surely need to check the password in the cookie!
If you read the login.inc file it check if $user is not set or if
$pw is not set of if the user and password combination is not valid
it then prompts the user to login.
It would be simple enough to duplicate for the docweb website.
Regards
--jm
>
> Nuno