php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #1726 problems with .htaccess and $php_auth_pw
Submitted: 1999-07-16 04:53 UTC Modified: 1999-07-18 20:19 UTC
From: zeep at jep dot de Assigned:
Status: Closed Package: Other
PHP Version: 3.0.11 OS: solaris
Private report: No CVE-ID: None
View Developer Edit
 [1999-07-16 04:53 UTC] zeep at jep dot de 
I found a problem with .htaccess and PHP authentication via realms. If I use the following .htaccess file (which only sends a http-authentication request if you are not accessing via the LAN) the PHP-authentication does not work anymore.

[.htaccess]
deny from all 
allow from 192.168. 
AuthType Basic 
AuthName "Pax"
AuthUserFile /opt/apache/htpasswd
AuthGroupFile /opt/apache/groups
require valid-user 
satisfy any

the php-source should looks like this:
[test.php3]
if (($PHP_AUTH_USER!="blabla") || ($PHP_AUTH_PW)!="blabla")) { 
  Header("WWW-Authenticate: Basic realm=\"Publish\"");
  Header("HTTP/1.0 401 Unauthorized");
  echo "please enter the password!";
  exit;
}

But the $PHP_AUTH_* variables are always empty! I think this is a problem with apache, but I am looking forward to read your opinion on this problem.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [1999-07-18 20:19 UTC] sas at cvs dot php dot net 
From http://www.php.net/manual/html/features.http-auth.html

In order to prevent someone from writing a script which reveals the password for a page that was authenticated through a traditional external mechanism, the PHP_AUTH variables
will not be set if external authentication is enabled for that particular page. In this case, the $REMOTE_USER variable can be used to identify the externally-authenticated user.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Mon Nov 17 04:00:01 2025 UTC