Auth

index.php

@@ -67,8 +67,58 @@ if( !$title ) { $title = clean_title(basename(dirname(__FILE__))); }
 
 //
 if ($use_password) {
-    if ($mode_register) register();
+    $realm = 'Restricted area';
-    else login();
+
+    //user => password
+    $users = array('admin' => 'mypass', 'guest' => 'guest');
+
+
+    if (empty($_SERVER['PHP_AUTH_DIGEST'])) {
+        header('HTTP/1.1 401 Unauthorized');
+        header('WWW-Authenticate: Digest realm="'.$realm.
+               '",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
+
+        die('Text to send if user hits Cancel button');
+    }
+
+
+    // analyze the PHP_AUTH_DIGEST variable
+    if (!($data = http_digest_parse($_SERVER['PHP_AUTH_DIGEST'])) ||
+        !isset($users[$data['username']]))
+        die('Wrong Credentials!');
+
+
+    // generate the valid response
+    $A1 = md5($data['username'] . ':' . $realm . ':' . $users[$data['username']]);
+    $A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
+    $valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);
+
+    if ($data['response'] != $valid_response)
+        die('Wrong Credentials!');
+
+    // ok, valid username & password
+    echo 'You are logged in as: ' . $data['username'];
+
+
+    // function to parse the http auth header
+    function http_digest_parse($txt)
+    {
+        // protect against missing data
+        $needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
+        $data = array();
+        $keys = implode('|', array_keys($needed_parts));
+
+        preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@', $txt, $matches, PREG_SET_ORDER);
+
+        foreach ($matches as $m) {
+            $data[$m[1]] = $m[3] ? $m[3] : $m[4];
+            unset($needed_parts[$m[1]]);
+        }
+
+        return $needed_parts ? false : $data;
+    }
+    //if ($mode_register) register();
+    //else login();
 }
 
 
@@ -480,6 +530,7 @@ function login() {
     if (!isset($_SERVER['PHP_AUTH_USER'])) {
         header('HTTP/1.1 401 Authorization Required');
         header('WWW-Authenticate: Basic realm="Access denied"');
+        echo 'Password required.';
         exit;
     } else {
         if (isset($USERS[$_SERVER['PHP_AUTH_USER']])) {