pcplantdb

[Chad Knepp <pyg@galatea.org>]

Richard Morris writes:
 > Chad Knepp wrote:
 > > Adding users is proving to be a little more complicated than I
 > > expected, but that is what I have been working on.  Most of the
 > > problem is that apache doesn't provide a cgi hook to http basic
 > > authentication and we need more flexibility than basic auth on its
 > > own.  I was hoping to have a release with users and comments ready by
 > > the time Stephanie got back, but that's only two days from now and I'm
 > > mighty distracted by a nine week old ball of black and white energy in
 > > the form of a Border Collie that entered my life this year.
 > > 
 > There seems to be two ways to to do logins.
 > 1) using http basic auth. Seems like this causes a special popup window 
 > to appear where users can put in login details.
 > 2) Just use a user name/password form, do our own login verification 
 > setting cookies and such like.
 > 
 > I noticed something in php manual about former yesterday
 >  >>>
 >   The HTTP Authentication hooks in PHP are only available when it is 
 > running as an Apache module and is hence not available in the CGI 
 > version. In an Apache module PHP script, it is possible to use the 
 > header() function to send an "Authentication Required" message to the 
 > client browser causing it to pop up a Username/Password input window. 
 > Once the user has filled in a username and a password, the URL 
 > containing the PHP script will be called again with the variables, 
 > $PHP_AUTH_USER, $PHP_AUTH_PW and $PHP_AUTH_TYPE set to the user name, 
 > password and authentication type respectively. Only "Basic" 
 > authentication is supported at this point. See the header()  function 
 > for more information.
 >  >>>
 > 
 > Generally I think I'd prefer the latter. Its more what people are used 
 > to. Are their any standard python libraries for this sort of stuff?

Yeah, I think we need more than basic auth.  Currently I'm using the
login module of Jalopy
<http://www.voidspace.org.uk/python/jalopy.html> as an example.  I'm
not happy with it on it's own because I want more control over the
cookie and it has a lot of features we don't need.  I think the
greatest threat of abuse is from message board spammers, which I think
we can avoid by not having completely automatic account generation.  I
think/hope that emailing a confirmation link will be a sufficient
deterrent.  Until a full release, accounts will probably be manually
generated.

 > Don't really know much about this stuff. For comments on pfaf site
 > I've never bothered with logins at all, i.e. anyone can add a comment.
 > As this does not destroy data its OK in my book.

The implementation I have in mind will not allow deletes over anything
but your own material.

 > Hope thats of some help
 > 
 > Rich
 > 
 > _______________________________________________
 > pcplantdb mailing list
 > pcplantdb@lists.ibiblio.org
 > http://lists.ibiblio.org/mailman/listinfo/pcplantdb