Ok, I'll try that, even if I'm not really sure if I can manage what you're talking about, bradgrafelman. Don't forget I'm a REAL newbie. My only knowledge in php is some very simple functions. I've just started to learn.
My problem is the .htaccess file. If I put it, it'll definately ask for the password. I had a script not very far from yours, krs1, checking the password and the username. But, it still asked for the password and username in the popup box, even though I had given them already...
My main problem is, it's not html pages I want to protect. I really don't care about someone stealing my html pages.
Here, I show you what my friend gave me. It works fine on his server, but his server accepts the .htpasswd thing, and crypted passwords, whereas mine doesn't seem to.
<?
include("secret/ee_fonctions.php");
$pb=0;
if (isset($_POST["valid"])) {
if ($_POST["valid"]==1) {
$pb = check_id($_POST["login"], $_POST["pass"]);
}
}
?>
<html>
<head>
<title>Ajouter un message pour l'Espace Entreprises de Farmer Corp ...</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<link href="../../style.css" rel="stylesheet" type="text/css">
<script language="JavaScript">
function check(){
var pattern = "^[ \n\t\r\f]*$";
var option = "g";
var reg=new RegExp(pattern, option);
var pb = 0;
var chaine = "Certains champs sont mal remplis :\r\r";
if (reg.test(document.id.login.value)) {
pb = 1;
chaine += "\t- votre login.\r";
}
var reg=new RegExp(pattern, option);
if (reg.test(document.id.pass.value)) {
pb = 1;
chaine += "\t- votre mot de passe.\r";
}
if (pb) {
chaine += "\rVous devez absolument les remplir pour vous identifier.";
alert(chaine);
} else {
document.id.submit();
}
}
</script>
</head>
<body class="soleil">
<table align="center" height="100%" width="100%" >
<tr>
<td width="100"></td>
<td width="150"></td>
<td width="269" height="5"></td>
<td width="81"></td>
<td width="100"></td>
</tr>
<tr class="baspage" valign="top">
<td></td>
<td class="paragraphe" colspan="2" height="5"><br>
<img src="../../../images/gribouilli.gif" width="25" height="31" align="texttop">
<span class="citation">Identifiez vous ...</span>
</td>
<td colspan="2" class="remarque"><br>
<img src="../../../images/fleche_orange.gif" width="20" height="10">
<a href="javascript:window.close()">Annuler</a>
</td>
</tr>
<tr>
<td colspan="2"></td>
<td height="40" class="ajoutpb">
<? switch($pb) {
case 1 : echo "Votre login est invalide !";
break;
case 2 : echo "Votre mot de Passe est invalide !";
break;
case 3 : echo "Un problème est survenu lors de l'accès à votre compte ...<br>Contactez-moi : <a href=\"mailto:pot@efrei.fr\">ici</a>.";
break;
}
?>
</td></tr>
<tr>
<td></td>
<td colspan="3" class="paragraphe">
Veuillez entrer le login et mot de passe qui vous ont été transmis:
</tr>
<form action="index.php" method="post" enctype="multipart/form-data" name="id">
<tr>
<td></td>
<td class="ajoutgauche">
Login :
</td>
<td>
<input type="hidden" id="valid" name="valid" value="1">
<?
if ($pb == 2) {
echo "<input type='text' id='login' name='login' size='20' maxlength='20' value='".$_POST["login"]."'>";
} else {
echo "<input type='text' id='login' name='login' size='20' maxlength='20'>";
}
?>
</td>
</tr>
<tr>
<td></td>
<td class="ajoutgauche">
Mot de Passe :
</td>
<td>
<input type="password" id="pass" name="pass" size="20" maxlength="20">
</td>
</tr>
<tr><td height="10"></td></tr>
<tr>
<td colspan="2" rowspan="2" valign="bottom" align="left">
<img src="../../../images/fonds/soleil_gauche.gif" width="186" height="220" align="absbottom">
</td>
<td height="30"><input type="button" onClick="javascript:check();" class="bouton" value="S'identifier">
</td>
</tr>
</form>
<tr>
<td height="156"></td>
<td colspan="2" valign="bottom" align="right">
<img src="../../../images/fonds/soleil_farmer.gif" width="181" height="100" align="absbottom">
</td>
</tr>
</table>
</td></tr>
</table>
</body>
</html>
this is the login page. The french things just say that you have to tner the password, or that it's not valid.
Here is the ee_fonctions.php :
function check_id($login, $pass) {
$fp = fopen("secret/pass.tof","r");
if (!$fp) {
$pb=3;
} else {
$pb = 1;
$verybrut = fread($fp, filesize("secret/pass.tof"));
fclose ($fp);
$brut = explode("|",$verybrut);
for($i=0; $i < sizeof($brut); $i++) {
$ident[$i] = explode("=",$brut[$i]);
if (trim($login) == trim($ident[$i][0])) {
if (trim($pass) == trim($ident[$i][1])) {
header("Location: [url]http://[/url]".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/ajout.php");
} else {
$pb = 2;
}
}
}
}
return $pb;
}
?>
The index.php is located in a folder, protected by an .htaccess file looking like that :
AuthUserFile /users/promo2004/pot/public_html/pages/ferme/prive/secret/.htpasswd
AuthName User
AuthType Basic
<limit GET>
require valid-user
</Limit>
Then, you have this "secret" folder, where ee_fonctions.php is located. This one contains a .htaccess file ( deny from all ), a .htpasswd file with an encrypted password, and the pass.tof file, which contains the passwords, formated like that :
username=password|
username2=password2
It works fine for him ( the friend ), but for me it doesn't at all. Mainly because I have nooooooo idea why the .htpasswd contains a password and username not corresponding at all to the ones contained in pass.tof.... and my friend did that long ago, when he was in school, so he doesn't remember at all what he put in the .htpasswd thing...
But, his login is exactly what I'd like to achieve, because of the .htaccess file, which still protects all files from being navigated to....
Do you have any idea how it works ? ( because, checking the files, I don't understand how it can bypass the popup box by him, even if it does... )
krs1, I think your script is better than his, so I'm almost certainly going to use yours, but do you know how I could put the .htaccess in a way that wouldn't bring the ugly popup back ??? 🙁
Thanks for helping me, guys !!!!
