note 66898 deleted from features.http-auth by bjori
| From: | bjori@php.net | Date: | Wed, 31 May 2006 18:30:07 +0000 |
| Subject: | note 66898 deleted from features.http-auth by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-112670@lists.php.net to get a copy of this message | ||
Note Submitter: Henrik Laurell
Reason: useless
----
Below code shows whats needed for safemode
and PHP version < 5.x
<?php
// source for digest mode copied and adapted for SafeMode
// and PHP 4.3.x.
// 060531 Henrik Laurell @ www.Laurells.net
//user => password
$users = array('admin' => 'mypass', 'guest' =>
'guest');
// tip from below examples.
$headers = apache_request_headers();
$_SERVER['PHP_AUTH_DIGEST'] = $headers['Authorization'];
$realm = "Test";
$uniqid = uniqid(""); // this function must have a param
// in PHP < 5.x
$uid = getmyuid(); // importent, system adds this
// to realm string
if(empty($_SERVER['PHP_AUTH_DIGEST']))
Authenticate(); // call stops here
// analyze the PHP_AUTH_DIGEST variable
if(!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) ||
!isset($users[$data['username']]))
die('Wrong Credentials !');
// generate the valid response
// (IMPORTENT: I added '-'.$uid for safemode)
$A1 = md5($data['username'].':' .
$realm.'-'.$uid.':' .
$users[$data['username']]);
$A2 = md5($_SERVER['REQUEST_METHOD'].':'.
$data['uri']);
$valid_response = md5($A1.':'.$data['nonce'].':'.
$data['nc'].':'.
$data['cnonce'].':'.
$data['qop'].':'.$A2);
if ($data['response'] != $valid_response)
die("Wrong Credentials !!<br>\n".
"response = ".$data['response']."<br>\n".
"compare = ".$valid_response."<br>\n".
"UID = ".$uid."<br>\n".
"uniqID = ".$uniqid); // extra values for testing only
// ok, valid username & password
print "You'r logged in as: " . $data['username'];
phpinfo(); // for testing only, for example checking
// the PHP_AUTH_DIGEST var.
function Authenticate()
{
global $realm,$uniqid,$uid;
header('HTTP/1.1 401 Unauthorized');
header('WWW-Authenticate: Digest realm="'.$realm.
'",qop="auth",nonce="'.$uniqid.
'",opaque="'.md5($realm).'"');
die('Wrong user or password.');
}
function http_digest_parse($txt)
{
// protect against missing data
$needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1,
'qop'=>1, 'username'=>1,
'uri'=>1,
'response'=>1);
$data = array();
preg_match_all('@(\w+)=([\'"]?)([a-zA-Z0-9=./\_-]+)\2@',
$txt, $matches, PREG_SET_ORDER);
foreach ($matches as $m) {
$data[$m[1]] = $m[3];
unset($needed_parts[$m[1]]);
}
return $needed_parts ? false : $data;
}
?>