Created
January 2, 2015 23:09
-
-
Save rchrd2/07251d6cf1acc4364340 to your computer and use it in GitHub Desktop.
Include protect.php to password protect a page
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php include 'protect.php';?> | |
| <!DOCTYPE html> | |
| <html> | |
| <head></head> | |
| <body>Secrets. </body> | |
| </html> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?php | |
| $realm = 'Restricted area'; | |
| //user => password | |
| $users = array('USERNAME' => 'PASSWORD'); | |
| if (empty($_SERVER['PHP_AUTH_DIGEST'])) { | |
| header('HTTP/1.1 401 Unauthorized'); | |
| header('WWW-Authenticate: Digest realm="'.$realm. | |
| '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"'); | |
| die('Text to send if user hits Cancel button'); | |
| } | |
| // analyze the PHP_AUTH_DIGEST variable | |
| if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) || | |
| !isset($users[$data['username']])) | |
| die('Wrong Credentials!'); | |
| // generate the valid response | |
| $A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]); | |
| $A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']); | |
| $valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2); | |
| if ($data['response'] != $valid_response) | |
| die('Wrong Credentials!'); | |
| // function to parse the http auth header | |
| function http_digest_parse($txt) | |
| { | |
| // protect against missing data | |
| $needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1); | |
| $data = array(); | |
| $keys = implode('|', array_keys($needed_parts)); | |
| preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@', $txt, $matches, PREG_SET_ORDER); | |
| foreach ($matches as $m) { | |
| $data[$m[1]] = $m[3] ? $m[3] : $m[4]; | |
| unset($needed_parts[$m[1]]); | |
| } | |
| return $needed_parts ? false : $data; | |
| } | |
| ?> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment