Single login with Basic authentication

[ecartz]

If you want to make Harald's integration with Basic authentication work, you need to change how Apache is configured. You can read more about that at https://stackoverflow.com/a/14809899/6660678 or https://httpd.apache.org/docs/trunk/mod ... gipassauth

Basically, you have to configure Apache to forward the PHP_AUTH_USER and PHP_AUTH_PW values to PHP. By default it doesn't do that to keep applications from tricking people into sharing their login information. That's why the compile-time setting is called SECURITY_HOLE_PASS_AUTHORIZATION.

Or if going through all that (rather finicky) configuration is too much work, you can just log in twice.

I describe the configuration as rather finicky because it keeps changing. CGIPassAuth is for Apache 2.4.13 and later. Older versions used SECURITY_HOLE_PASS_AUTHORIZATION or the mod_rewrite/SetEnvIf workarounds. So people report various things as working for them that don't work for other people.

The code to handle this in Phoenix is still there and was still working the last time I went through the steps to forward the relevant information.

[loop]

Hi ecartz

i added to my admin .htaccess this line

Code: Select all

CGIPassAuth On

and whenn i make a echo in the next login.php page with the input fields

Code: Select all

echo "Username: " . $_SERVER[PHP_AUTH_USER] . ", Password: " . $_SERVER[PHP_AUTH_PW];

i have the perfect user / password in there. so it should work.

The question is, you wrote that the old oscommerce login script is still there, can you tell me where? or how i can tell the script to use the $_SERVER[PHP_AUTH_USER] and $_SERVER[PHP_AUTH_PW] for auto login?

i could change the login.php and try to make a redirect to the normal form with the username /password i have, but if the code already exist it would be nicer to use it, thank you!

edit: i'm getting to the next level, i found it in the application_top.php:
i found out, whenn i make in the login.php

Code: Select all

  print_R($_SESSION['redirect_origin']);
  die();
  gets this result:
  Array ( [page] => index.php [get] => Array ( ) [auth_user] => xxx[auth_pw] => xxx) (where xxx is the correct user /pw)
  

i have my login information including password in this session, but i still see normal login.php information. so evrything is inplace in the session, but the login.php does not make anything with username /password in the $_SESSION['redirect_origin'] and still ask me for password..

[ecartz]

admin/includes/application_top.php
admin/includes/actions/login/process.php

Maybe

Code: Select all

class hook_admin_login_basic {

  public function listen_preAction() {
    if (isset($_SESSION['redirect_origin']['auth_user']) && !isset($_POST['username'])) {
      $GLOBALS['always_valid_actions'][] = 'process';
    }
  }

}

That (form protection on the login page) seems like the only thing that might have changed recently.

[loop]

hi ecartz
Thank you!
as i'm not on the newest build (1.0.8.7) i didn't had this hook.

i made the hook as you wrote and added it, and everyething worked like a charm!
so for others to get it work, i made 2 changes:
in the .htaccess of the admin, i added: CGIPassAuth On
and i added the function which ecartz told me:

Code: Select all

<?php
class hook_admin_login_basic {

public function listen_preAction() {
  if (isset($_SESSION['redirect_origin']['auth_user']) && !isset($_POST['username'])) {
    $GLOBALS['always_valid_actions'][] = 'process';
  }
}

}
?>

i do not know why this hook isn't there in 1.0.8.7 or why it should worked the login before this hook, but anyway...with this hook it works
thank you!