Administrator Login

[barnessc]

What's is the best way to allow the adminstrator to login into the admin pages of a OSCommerce website? There is a contribution out there called Admin Auth that gives this code, but I do not understand what it does. After I implement the code it ask for a username, password, and domain. Any help would be appreciated.

 

Quick Setup of Admin Authentication.

 

// Open /admin/includes/application_top.php add the following code in

// include authentication user/password of administration

require(DIR_WS_INCLUDES . 'authen.php');

 

// Open /admin/includes/configure.php and add the following code in

// define admin user/password

define('ADMIN_USERNAME', 'admin');

define('ADMIN_PASSWORD', 'mypasword');

 

 

// Save the following PHP codes as authen.php in /admin/includes/authen.php

<?php

 

if(!isset($PHP_AUTH_USER))

{ header('WWW-Authenticate: Basic realm="' . TITLE . '"');

header('HTTP/1.0 401 Unauthorized');

echo $SERVER_NAME . ' Authorization Required.';

exit;

}

else

{ if (($PHP_AUTH_USER != ADMIN_USERNAME) || ($PHP_AUTH_PW != ADMIN_PASSWORD))

{ header('WWW-Authenticate: Basic realm="' . TITLE. '"');

header('HTTP/1.0 401 Unauthorized');

echo $SERVER_NAME . ' Authorization Required.';

exit;

}

}

 

?>

 

Thanks in advance,

Scott Barnes

[toolcrazy]

Actually, your best security is a .htacces file. This is more secure. The one that you are talking about isn't very secure. Someone can come in the backdoor and get a copy of the file with your password and user name.

 

Search for .htaccess

 

I remember seeing a very involved thread on the subject.

[Diniel]

try my post at http://www.oscommerce.com/forums/viewtopic.php...p=114858#114858 , it details how to set up .htaccess protection of your Admin area, even without a Control Panel from your ISP

[barnessc]

Does the .htaccess and .htpasswd work using IIS5.0?

 

Thank you,

[Diniel]

So far as I know, it's only an Apache thing... I've only ever used Apache servers though, IIS has too much bad press.

[barnessc]

Does anyone know of a similiar feature to htaccess for IIS?

 

Thank you,