Well, assuming config.php sets
$adminuser and $adminpass , it seems like there is a flaw in authentication. $adminpass should already be md5, so you should change
CODE
$adminpass = md5($adminpass);
-to-
$cookpass = md5($cookpass);
I did not look at the url so I don't know, but thats how it should be.
As far as files in other folders, well, I'll give you my overlook of this auth.
You shouldn't be storing usernames/passwords in cookies, it's insecure. Instead use sessions.
CODE
// config.php
$adminuser = "joey";
$adminpass = "asdjahdoasoid"; // MD5 of password
// Login.php
$username = $_POST['username'];
$password = md5($_POST['password']);
if($username && $password){
if($username = $adminuser && $password = $adminpass){
$_SESSION['authed'] = 1;
} else {
// show error message
}
//Show login form
Then on other pages include this at the top of your secured pages.
CODE
isset($_SESSION['authed']) ? null:header("Location: login.php");
For protecting directories though, you might want to look into .htacces at server level, that would be abetter solution.
26 May, 2008 - 12:06 AM
| 