To what file?
Perhaps he meant the file used to create/check the magic cookie ? We are
talking about it in this thread.
That doesn't make sense to me. Can you please summarize how this is
going to work?
What we would like to have:
- respect *.php.net MAGIC_COOKIES on docs.php.net
- let users log in on docs.php.net with CVS user properties
(ie. set their magic cookie)
All *.php.net machines receive the magic cookie if it is set (all mirror sites and subsites). But that does not mean we can trust the cookie. We need to be able to check whether users provide proper login details or not (whether the magic cookie contains proper information or not). This would be possible with the cvs passwd file, but we are not going to get it. So we need a 'on user action check' which involves some machine which is able to authenticate with the MAGIC_COOKIE.
This means:
- when someone tries to login on docs.php.net, we send the login
details with POST or GET to master.php.net
- if we get back a magic cookie, then the login details are perfect,
so we set the MAGIC_COOKIE and set our own 'trusted user' server
side session flag (we would not like to put a request on the master
server for all requests on the docs server)
- similar if we see a MAGIC_COOKIE but no 'trusted user' server side
session variable
We can code the above playing with CURL and the current login form available on the master server, or we can create a new file, which would do this for us with GET, so it is easier to program. That file can be protected with a new token or an IP based request handling restriction. So we can do it without any intervention from systems@, but we would like to do it in a way you know and agree to.
Goba