Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:12941
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Message-ID: <6.1.2.0.0.20040922231944.041595f8@127.0.0.1>
Date: Wed, 22 Sep 2004 23:26:28 +0200
To: "Kamesh Jayachandran" <kameshj@fastmail.fm>,
	internals@lists.php.net
In-Reply-To: <1095863649.14268.204915460@webmail.messagingengine.com>
References: <1095863649.14268.204915460@webmail.messagingengine.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Subject: Re: [PHP-DEV] Why to have owner's uid of the file when
  WWW-Authenticate header?
From: thetaphi@php.net (Uwe Schindler)

Something additional to this:
I am fixing bug #29805 (HTTP Authentication Issues in NSAPI).

Copied from some other SAPIs I have done this by adding of the following line:

         if (!PG(safe_mode)) 
php_handle_auth_data(pblock_findval("authorization", rq->headers) TSRMLS_CC);

The problem is: Apache disables this in safe mode only if some other 
authentication (like .htaccess) is active. In NSAPI you cannot check this, 
so I disabled the whole authentication in NSAPI. Other SAPIs do not check 
for safe mode.

What is the background of disabling of passing the headers "Authentication" 
and the user/password pairs in it to the user? Is it a problem to simply 
give the user access to this information (even with safe mode) - If there 
is some authentication by .htaccess or something other it is normally from 
the same user that wrote the script.

Uwe

At 16:34 22.09.2004, you wrote:
>Hi All,
>
>I want to know the reason behind the having the uid of the owner of the
>file shown as a part of realm string the WWW-Authenticate when safe_mode
>is enabled.
>
>
>With regards
>Kamesh Jayachandran
>
>--
>PHP Internals - PHP Runtime Development Mailing List
>To unsubscribe, visit: http://www.php.net/unsub.php

-----
Uwe Schindler
thetaphi@php.net - http://www.php.net
NSAPI SAPI developer
Erlangen, Germany