Newsgroups: php.internals,php.webmaster
Path: news.php.net
Xref: news.php.net php.internals:73775 php.webmaster:18803
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain hawaii.edu designates 209.85.216.176 as permitted sender)
MIME-Version: 1.0
Date: Thu, 24 Apr 2014 05:58:17 -1000
Message-ID: <CAOsfcJPKnoQ=UVze6xwvV7oG7AjUFxOBZRAFKQG1iSKy-KkG6Q@mail.gmail.com>
To: internals@lists.php.net, php-webmaster@lists.php.net, 
	Zeev Suraski <zeev@zend.com>, Zak Greant <zak@mysql.com>, Georg Richter <georg@php.net>, 
	Andrey Hristov <andrey@mysql.com>, Ulf Wendel <uwendel@mysql.com>, 
	George Schlossnagle <george@omniti.com>, Johannes Schlueter <johannes@mysql.com>
Content-Type: multipart/alternative; boundary=001a113a970ae2bb8704f7cbea45
Subject: fork of php mysql[i][nd] extension for script filehash based db auth
From: jvelasqu@hawaii.edu (Juan Velasquez)

--001a113a970ae2bb8704f7cbea45
Content-Type: text/plain; charset=ISO-8859-1

Aloha,
      I'd like to see a fork of the mysql extensions and perhaps other
databases (I'm actually a little partial to postgres),   that allows mysql
to authenticate php scripts based on their file contents, or hash, or inode
modification time.   Basically during mysql_[p]connect() calls,

    1. checks if feature is enabled,
    2. gathers additional data
               script path and name hash,
               script file contents hash  (only computed if mtime changed),
               script file inode mtime,
               desired database name,
    3.  then uses this data as a key to a flat file berkeley db in
/etc/php5/
    4.  where it could be returned a data record containing
                mysql hostname,
                real database name,
                real username,
                real password,
    5.  and then transparently continues it's connection to mysql,
    6.  and upon success returns the connection to the php script, which
never knew the difference.


I'm almost done coding this idea into the old mysql extension for a proof
of concept and assuming it received positive feedback would enjoy coding it
into mysqli or mysqlnd, or others. I also coded up a little helper program
for managing the bdb table,  to create, add, update, and remove records
from the /etc/php5/mysql_auth.db database,  that the extension consults
upon page requests.

I'm doing this for a school project, for extra credit in my Software
Engineering class.
It'd be great if this idea really worked,  and if there was not some huge
hole in my thinking on this subject.   In any case I welcome opinions on it.

I'm particularly interested in knowing what fields would be useful in the
key and data.


thank you.
/juan



-- 

"only during tornadoes do apples fall far from the tree."   Juan Velasquez
"there's reasons for everything, though it's too bad too often a no good
reason."  Juan Velasquez

--001a113a970ae2bb8704f7cbea45--