Re: Chmod & security & authentication

On Sun, 16 Jul 2000, Marijn Speelman wrote: > Hi there, > > I have a problem with chmod and PHP. I have a txt file 'database' but I > don't want people who know the name of that file be able to view that file. > I know you can chmod the file 660 so nobody can acces the file via your > browser. Perl reads and writes a file (with 660) correctly, but with PHP and > just can't read the file! What can I do to secure this file? (htacces is not > an option) You probably have your perl scripts running under cgiwrap or suexec. These are wrappers that let a CGI process run as the owner of the script/program, rather than as the user apache runs as - usually 'nobody'. Therefore the perl stuff can rw the text file because it is running as 'marijn', or whoever you are. PHP as a module is part of apache and so comes along as 'nobody' and cant get into your db. The only solution is to put your db file above the web root and chmod 644. Not great since anyone else with a login on your server can read the db if they know the path, but AFAIK the best you can get under that situation. > > And another question: I have basic realm authentication, but I want to > logout a user. The PHP manual says some things about that, but that doesn't > work. How can I do that? > Also, when I want a user to re-login, I change the PHP_AUTH_USER, and the > page pops-up the login screen. Only, NO password or username matches after > that. Really irritating me :) > I dunno what it says in the manual but I thought the only way to reliably log out with Basic Auth was to restart the browser. A big drawback - and only one of them. Somewhere in the docs for PHPLIB is a list of about ten reasons why Basic Auth is inferior to session management and logins using HTML forms. Sorry I don't have the URL but if you can find it I encourage you to be convinced good luck ;) > Hope you can help me (and sorry for the crappy english :)) > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >