RE: [PHP] security and .htaccess

At 8:46 AM -0700 12/4/06, Frank Reichenbacher, Bio-Concepts, Inc. wrote:

-----Original Message-----

From: tedd [mailto:tedd@sperling.com] Sent: Monday, December 04, 2006 08:29 To: php-general@lists.php.net; ceo@l-i-e.com; frank@bio-con.com Subject: RE: [PHP] security and .htaccess

<snip>

At 8:57 PM -0700 12/3/06, Frank Reichenbacher wrote:

That is the MS FrontPage auth system. Directories beginning with _ underscores cannot be viewed in your browser. Unless you want to dump FrontPage, you do not want to be messing with this setup. If you can't view these directories in FrontPage, it's because you do not have the website set to show hidden files. Tools>Site Settings.

Ahhh, thanks -- so it's a FrontPage phenomena. I was wondering about that. I've heard enough bad things about FrontPage to shy away from that. I've used both .htacess (AuthUserFile ) and pulling a md5 encrypted password from MySQL -- is one method more secure than another or are they both about the same?

I can't comment on the last question, but before you do anything, contact your hosting company and tell them to uninstall the FrontPage extensions that are currently supposed to be managing your content. It's about 10MB worth of cgi. It will (I think) return access control to .htaccess and .htpasswd and will alter the .htaccess to the default security. Otherwise you will be hacking up the whole structure piece-by-piece. I use FrontPage to manage several websites, but there are some things that it gets in the way of since my servers are all UNIX. Frank

Frank: I appreciate the advice and I would uninstall FrontPage (have done so on other sites) if I were the lead programmer in this deal. However, sharper minds than mine apparently know better. I've looked at the project in question and with over 16,500 files, I've decided to pass. Sometimes I just don't understand why people make things so hard on themselves. Thanks to all. tedd -- ------- http://sperling.com http://ancientstones.com http://earthstones.com