Re: New pear extension HTTP_HTAccess

OK - it seems like I was missing something for some reason File::Passwd exists in php4 cvs but NOT pear cvs (Why is this???? are they seperated or not?) This class uses crypt, I originally began using this method, but using on Win32 doesnt work since it reverts to MD5 encription (strings like $apr1$CB/.....$OasVqSFVAbAJCShZxPdzW0 instead of the shorter crypt version) I ended up having to use the htpasswd binary, which always worked... and should have more future compatability than using crypt. IMHO, i dont think having this dependency is a problem. On another point, do you have any thoughts on a security model for using this, it would seems unsafe to include a verifyUser function, since the .htpasswd must be visible to the server, anyone with access to this class can easilly (given enough time) crack any .htaccess/pserver protected directory using either a dictionary, or even an incremental sequential string aaaaaaa, aaaaaaab etc etc. Mike At 14:35 07/06/2002 +0300, Mika Tuupola wrote:

On Fri, 7 Jun 2002, Michael Dransfield wrote: I would like to contribute this extension to PEAR. It creates and modifies .htaccess files and .htpasswd files, can add/edit/delete users from the file. It needs preg expressions and the actual htpasswd binary. It

        File_Passwd allready manages .htpasswd files and does not
        need htpasswd binary.

        Would be interested in seeing the source for the class accessing
        .htaccess files though. Do you have it available somewhere?. I
        also did a quick hack of a class for modifying .htaccess files
        earlier (not finished though). Maybe we could share some
        ideas.

        http://www.appelsiini.net/~tuupola/php/File/HtAccess.phps

--

Mika Tuupola                      http://www.appelsiini.net/~tuupola/