note 108233 added to features.http-auth

I tried example 7, and at first I couldn't get it to work. It took me a while to spot that somewhere along the line, probably by the server, a seemingly random number was being added to the realm - so the valid_result variable wasn't calculated using the correct realm. To get around this, or any similar problems, make the following changes to the example: Around line 43 (44 if after next step ;) ): $needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1, 'realm'=>1); Before line 24: $realm = $data['realm']; These two steps get the real realm used for the authentication request, and substitute it into the "valid_response" query. Hope this helps :) idbobby at rambler dot ru 12-Aug-2010 02:31 First of all, sorry for my English. One more authorization script with logout solution. In script given by meint_at_meint_dot_net (http://www.php.net/manual/en/features.http-auth.php#93859) rewrite_module is used. If there are any problems with that module and possibilities of administration of the web-server are restricted (including restrictions for use of .htaccess) then you can use this solution. index.php --------- <?php $auth_realm = 'My realm'; require_once 'auth.php'; echo "You've logged in as {$_SESSION['username']}<br>"; echo '<p><a href="?action=logOut">LogOut</a></p>' ?> auth.php -------- <?php $_user_ = 'test'; $_password_ = 'test'; session_start(); $url_action = (empty($_REQUEST['action'])) ? 'logIn' : $_REQUEST['action']; $auth_realm = (isset($auth_realm)) ? $auth_realm : ''; if (isset($url_action)) { if (is_callable($url_action)) { call_user_func($url_action); } else { echo 'Function does not exist, request terminated'; }; }; function logIn() { global $auth_realm; if (!isset($_SESSION['username'])) { if (!isset($_SESSION['login'])) { $_SESSION['login'] = TRUE; header('WWW-Authenticate: Basic realm="'.$auth_realm.'"'); header('HTTP/1.0 401 Unauthorized'); echo 'You must enter a valid login and password'; echo '<p><a href="?action=logOut">Try again</a></p>'; exit; } else { $user = isset($_SERVER['PHP_AUTH_USER']) ? $_SERVER['PHP_AUTH_USER'] : ''; $password = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : ''; $result = authenticate($user, $password); if ($result == 0) { $_SESSION['username'] = $user; } else { session_unset($_SESSION['login']); errMes($result); echo '<p><a href="">Try again</a></p>'; exit; }; }; }; } function authenticate($user, $password) { global $_user_; global $_password_; if (($user == $_user_)&&($password == $_password_)) { return 0; } else { return 1; }; } function errMes($errno) { switch ($errno) { case 0: break; case 1: echo 'The username or password you entered is incorrect'; break; default: echo 'Unknown error'; }; } function logOut() { session_destroy(); if (isset($_SESSION['username'])) { session_unset($_SESSION['username']); echo "You've successfully logged out<br>"; echo '<p><a href="?action=logIn">LogIn</a></p>'; } else { header("Location: ?action=logIn", TRUE, 301); }; if (isset($_SESSION['login'])) { session_unset($_SESSION['login']); }; exit; } ?> ------------------ How can I Convert this to md5 hash? ---- Server IP: 69.147.83.197 Probable Submitter: 79.176.141.89 ---- Manual Page -- http://www.php.net/manual/en/features.http-auth.php Edit -- https://master.php.net/note/edit/108233 Del: integrated -- https://master.php.net/note/delete/108233/integrated Del: useless -- https://master.php.net/note/delete/108233/useless Del: bad code -- https://master.php.net/note/delete/108233/bad+code Del: spam -- https://master.php.net/note/delete/108233/spam Del: non-english -- https://master.php.net/note/delete/108233/non-english Del: in docs -- https://master.php.net/note/delete/108233/in+docs Del: other reasons-- https://master.php.net/note/delete/108233 Reject -- https://master.php.net/note/reject/108233 Search -- https://master.php.net/manage/user-notes.php