What if we were to arrange with Zend to provide us we a copy of their
Zend Encoder and use some encryption routines which can decode the password
file and extract the encrypted hash and check if the md5(secret . md5(crypt($pass)))
matches or something where we don't know the 'secret key' set by systems
and we cannot view the source for this php script. One requirement would be
that we would need to run zend optimizer ont he docs webserver.
Ehem, this is way too much overcomplication IMHO. All the *.php.net servers see the MAGIC COOKIE (and other cookies set for this domain). This means all subsites and mirror sites. We just need a way to check if the MAGIC COOKIE contains proper details, and the user is to be trusted as being that one identified by that cookie. Or login the user if he has not logged in yet.
Goba