Message-ID: <37A839F0.733D9A9F@sharp.fm>
Date: Wed, 04 Aug 1999 15:02:40 +0200
From: Graham Leggett <minfrin@sharp.fm>
MIME-Version: 1.0
To: new-httpd@apache.org
Subject: Re: Passing passwords to CGI
References: <Pine.BSF.4.05.9908041407060.3269-100000@kim.ispra.webweaving.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: new-httpd-owner@apache.org
Precedence: bulk
Reply-To: new-httpd@apache.org
Status: O

Dirk-Willem van Gulik wrote:

> > Is there a "correct" way of doing this?
> 
> No, of course not :-) but the solution is
> 
> Adding to your cflags
> 
>         CFLAGS += -DSECURITY_HOLE_PASS_AUTHORIZATION
> 
> Do a grep in the source (util_script.c) for the full story.

Here's a thought - how about including the capability for passwords to
be inserted into the POST data that a CGI reads via stdin, ie the
password could be read as if it was simply another option on a form.

The name of this POST variable would be configurable so it didn't clash
with any existing variables in CGI.

Is this a good idea? If so, I'll try get it to work.

Regards,
Graham
-- 
-----------------------------------------
minfrin@sharp.fm		"There's a moon
					over Bourbon Street
						tonight...