Re: login with CVS accounts on docs.php.net
| From: | Nuno Lopes | Date: | Fri, 11 Jun 2004 08:11:23 +0000 |
| Subject: | Re: login with CVS accounts on docs.php.net | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.doc.web |
| Request: | Send a blank email to doc-web+get-34@lists.php.net to get a copy of this message | ||
> On Thu Jun 10 12:45:34 2004 Gabor Hojtsy wrote:
> > As I have seen, the bugs and master machines have the user/pass DB, plus
> > Wez's blog allows us to log in with our CVS users, so I guess he also
> > has a copy of the password file. I cannot estimate the security conserns
> > of giving out the password file for our server, we will discuss this
> > with systems@ (also CC-ed). We would need the token for
> > http://master.php.net/fetch/cvspasswd.php
> >
> > Goba
>
> It's simple to implement a http post to either the pear website,
bugs.php.net,
> or master.php.net sites to check if you post the login details if you get
> sent a cookie back.
>
> Regards
> --jm
Probably this is the best idea:
the server would check for the magic cookie. Then would get and url from the
master server like auth.php?cookie=$MAGIC_COOKIE
If it authenticates, it would create a session or a cookie for our domain
(with a temp code stored in our DBs).
Nuno