Re: Re: login with CVS accounts on docs.php.net

On 11 Jun 2004, at 21:03, Mehdi Achour wrote:

Gabor Hojtsy wrote:

What if we were to arrange with Zend to provide us we a copy of their Zend Encoder and use some encryption routines which can decode the password file and extract the encrypted hash and check if the md5(secret . md5(crypt($pass))) matches or something where we don't know the 'secret key' set by systems and we cannot view the source for this php script. One requirement would be that we would need to run zend optimizer ont he docs webserver.

Ehem, this is way too much overcomplication IMHO. All the *.php.net servers see the MAGIC COOKIE (and other cookies set for this domain). This means all subsites and mirror sites. We just need a way to check if the MAGIC COOKIE contains proper details, and the user is to be trusted as being that one identified by that cookie. Or login the user if he has not logged in yet.

Yep, it's a bit to complicated for me too :) +1 on using B. Btw, systems, any problem to use this one ? We'll keep the token out of the cvs module, somewhere on the server. The token isn't going outside the trusted area of very few systems machine. period. not going to happen.