Private mode & Addon verfification

[buzzdee]

Hi,
I received quite a lot abuse reports the last days, therefore I think about making my site accessible only with password ("private mode"). But now the tricky part:

If I set "private mode" and set a "user password", the uploads via browser is only possible with password. OK. But what about the uploads via my Firefox Addon? Will it still be possible to upload through Addons? And how can I modify my Addon to implement this "password" in it? How looks the password request in private mode?

Thanks for your help,
Buzz

 

[Rodolfo]

The only option will be to use your addon with api mode private.

 

[buzzdee]

Mhmm.... Currently the API-Key for my Addon is set to private and is passed in the URL. Well, I think it's a bit confusing: We have a private mode with password on the one hand (website), and a public/private mode on the other hand (API) - but actually they have nothing to do with each other...
Do you think that this is the best way, to handle my needs ?!:
- I set the website to private and set a password.
- This password functions also as API-Key (private mode), and the user must fill out this key in the addon (if he does, the API-Key will be passed in the URL, if he doest, upload is not possible)

Thanks for your help,
Buzz

 

[Rodolfo]

You should code a addon that ask for password then, I'm afraid that is the only solution. You can also limit the uploads by IP or something. Things is that you are limiting the public usage you should also limit the Firefox plugin.

 

[buzzdee]

@Rodolfo,

You should code a addon that ask for password then

Well, thats not the problem. The problem is, I don't know how to set up a single custom page using the login system of chevereto. I had a look at the "class.login.php" but... whoooo... there's a lot of stuff in there.
Could you please give me a hint, how to get started? I just need a single page, where the user could put in the password, and this is checked by the chevereto "login-system"....

Thanks,
Buzz

 

[Rodolfo]

You shouldn't rely on the login class. Instead of that create user and password combos for each plugin user. Then create your own api.php with user password combos for this users.

 

[buzzdee]

OK, but where in the api.php do I define the combos? I see only this relevant line...

$key= $_REQUEST['key'];

 

[Rodolfo]

create the combos that you will need. Is that simple.
If you will need "?user" then just do something like $user = $_REQUEST['user'];

Try to check the requested vars for hack attempts (clean the var) before any handle after that.