Re: [PEPr] Call for votes on Authentication::Auth_HTTP_Digest

Martin Jansen wrote:

On Sat Feb 28, 2004 at 11:5821AM +0900, Rui Hirokawa wrote:

And, in the current implementation, password verify process is included in fetchData method of container class. I think container and verification should be clearly divided and verifyPassword() should be called from Auth class itself, not from container class. I suggest that fetchData($username, $password) of container class of should be fetchData($username) to divide verification from container.

This seems to make sense for me. But you should actually negotiate that with the maintainer of Auth, Yavor Shahpasov, because the containers are all taken from the Auth package.

Since this is basically a BC change, I propose one of the following solutions a) Cheap overload, if only one parameter is passed to fetchData ex: $authcontainer->fetchData($username) - the user data will be returned in an assoc array and false if the user is not found $authcontainer->fetchData($username,$password) - wourld work as before b) Implement a new method fetchUserData which will accept one parameter $username and will return the userdata You should keep in mind that most password are kept in the database in an encrypted/hashed form (md5/crypt), am not sure how your challenge responce works, but keep in mind that the pass would not be the real pass. You mmight need to check the cryptType auth option and adjust the verification of the digest. Let me know which solution you like more. Yavor -- Yavor Shahpasov yavo@siava.org