Return-Path: Delivered-To: new-httpd-archive@hyperreal.org Received: (qmail 13093 invoked by uid 6000); 25 May 1998 10:03:01 -0000 Received: (qmail 12911 invoked from network); 25 May 1998 10:02:57 -0000 Received: from adler.unix-ag.uni-siegen.de (141.99.42.52) by taz.hyperreal.org with SMTP; 25 May 1998 10:02:57 -0000 Received: from doubleshadow.unix-ag.org (isdna73.hrz.uni-siegen.de [141.99.174.73]) by adler.unix-ag.uni-siegen.de (Mailhost) with ESMTP id MAA04485 for ; Mon, 25 May 1998 12:00:11 +0200 Received: (from sfx@localhost) by doubleshadow.unix-ag.org (Mailhost) id MAA00397 for new-httpd@apache.org; Mon, 25 May 1998 12:04:36 +0200 Message-ID: X-Mailer: XFMail 1.3 [p0/sfx] on Linux X-Priority: 3 (Normal) Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: X-PGP-KeyID: F88341D9 Date: Mon, 25 May 1998 12:04:36 +0200 (CEST) Organization: German Unix-AG Association From: Lars Eilebrecht To: new-httpd@apache.org Subject: Re: general/2270: Required Patches to Apache sources for FrontPa Sender: new-httpd-owner@apache.org Precedence: bulk Reply-To: new-httpd@apache.org According to Gregory A Lundberg: > Only one problem: this all depends upon having mod_auth, .htacess files, > group and user (htpasswd) files. What happens if one of these isn't > there? Why we let _anyone_ .. that's right .. anyone in the world .. have > at our nice Frontpage (or whatever) CGIs. That sucks raw eggs at MACH 9 > through a straw doesn't it? All this work making things secure and some > dumb user FTPs in and DELEtes his .htaccess file blowing it all away. Why do you want to use .htaccess at all? IMHO such security relevant things should only go into the main server configuration. > So we need one last change: we need to be ABSOLUTELY SURE _this_ URL was > approved through mod_auth with a valid .htaccess and a valid password > challenge and response. IMHO a check with ap_some_auth_required() is sufficient. If authentication fails the request is already kicked out by mod_auth_any and with a call to ap_some_auth_required() you know that there is a require directive for this request and the user has been authenticated. Or am I wrong? ciao... -- Lars Eilebrecht - Did you know... sfx@unix-ag.org - That no-one ever reads these things? http://www.home.unix-ag.org/sfx/