Re: Status & CVS & objects

[Jason Pincin <chardros@linuxkb.org>]

Yeh - we can't require cookies.  crypt is cool - I assume your going to be
storing passwords via php's crypt() function then?  Cool.

As far as authentication... cookies are optional.  But we are using httpauth in
order to have session level authentication.  I want someone to come up with a
way to do this in php so an auth doesn't take TWO connections to the DB, as now
it requires one php and one mod_perl. 

If someone doesn't give it a look soon, maybe I'll give it a gander when I
impliment the object security which was #2 or 3 on my list...

What we are making optional with cookies (and thus you should account for on
signup) is:  if the user chooses to accept an account cookie - they won't have
to login every time they return to the site to restore there preferences.  

While I'm thinking of it - I think we should make this option only valid for
standard-security users.  Run of the mill who just want to customize the things
available to them, but don't want a login prompt with every visit.  Then, we can
either store there site passwd as a cookie, or some kinda checksum or sumthin,
and have them auto-auth when they visit - or sore they're site preferences as
cookies... nah... the checksum or sumthin would werk better.

At any rate - my point is - this should be disabled for users with advanced
privleges.  People with admin access to branches of the tree should not be
allowed to store auth cookies methinks.  Someone finds out, walks up to there
browser, and voila - hoses our tree.

Thoughts?

Jason


On Thu, Nov 04, 1999 at 12:09:41AM -0800, Micah K Yoder wrote:
> ok..........
> 
> am ready to test my attempt at getting signup.php3 working with the
> object system, but....
> 
> the CVS permissions really do need to be fixed.  CVS aborts before it
> gets to users.  when I checkout, I can do cvs co main/users but
> webupdate main doesn't allow that.
> 
> when I hit http://dev.linuxkb.org:81/users/tools/signup.php3 I get a 404
> Not Found.  Why am I not even getting the *old* signup.php3?  It used to
> be there...
> 
> Passwords... Aaron, you might want to do what you need to do to switch
> over to crypt() for authentication, cause that's how it's gonna work! 
> :-)
> 
> Speaking of authentication, there's another way that we use at work, but
> it REQUIRES cookies (at least temporary ones).  It's somewhat slick, but
> I guess the required cookies make it out of the question...???  It
> involves getting an md5() hash of the username, time logged in, and
> maybe something else... I'd have to check...  and storing it in a
> database table.

-- 
Jason
http://vodka.linuxkb.org/~chardros