Re: login with CVS accounts on docs.php.net
| From: | Jacques | Date: | Fri, 11 Jun 2004 09:41:53 +0000 |
| Subject: | Re: login with CVS accounts on docs.php.net | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.doc.web |
| Request: | Send a blank email to doc-web+get-37@lists.php.net to get a copy of this message | ||
On Fri Jun 11 09:11:23 2004 Nuno Lopes wrote:
> > On Thu Jun 10 12:45:34 2004 Gabor Hojtsy wrote:
> > > As I have seen, the bugs and master machines have the user/pass DB, plus
> > > Wez's blog allows us to log in with our CVS users, so I guess he also
> > > has a copy of the password file. I cannot estimate the security conserns
> > > of giving out the password file for our server, we will discuss this
> > > with systems@ (also CC-ed). We would need the token for
> > > http://master.php.net/fetch/cvspasswd.php
> > >
> > > Goba
> >
> > It's simple to implement a http post to either the pear website,
> bugs.php.net,
> > or master.php.net sites to check if you post the login details if you get
> > sent a cookie back.
> >
> > Regards
> > --jm
>
>
> Probably this is the best idea:
> the server would check for the magic cookie. Then would get and url from the
> master server like auth.php?cookie=$MAGIC_COOKIE
> If it authenticates, it would create a session or a cookie for our domain
> (with a temp code stored in our DBs).
>
> Nuno
Something like the following proof-of-concept code will most likely work,
and limits the usage to the server's ip address in question. One would
need to parse the output from the script for the docs.php.net site.
<?php
// $Id:$
require_once 'cvs-auth.inc';
$user = null;
$pw = null;
if ($_SERVER['REMOTE_ADDR'] != 'xx.xx.xx.xx') {
die ("ERR: Permission denied.");
}
if (isset($_GET['credential'])) {
list($user, $pw) = explode(":", base64_decode($_GET['credential']));
} else {
die ("ERR: No credential passed.");
}
if (verify_password($user, $pw)) {
die ("OK");
} else {
die ("ERR: Login failed.");
}