ckfinder autorisation and htaccess

hi there, hope you can help me.

i am a noob in php, so my questions maybe a bit stupid. i want to use ckfinder in fckeditor. i setup everething yet.
when i try to browse in ckfinder, theres a message, the tool is disabled. i read a lot about the CheckAuthentication
but i dont know whats that all about... :oops:

so, i got a htacces file one folder above. i enabled

return isset($_SESSION['IsAuthorized']) && $_SESSION['IsAuthorized'];

Fri, 09/05/2008 - 09:19

wiktor

Joined: 16/07/2007

Posts: 1641

Re: ckfinder autorisation and htaccess

How does your .htaccess look like? Do you have there lines responsible for authentication?
Here's an example how to restrict access to a site/directory: http://www.apacheweek.com/features/userauth

Basically, if you already have a HTTP authentication enabled, you may return true in CheckAuthentication - but only, if you have to login first to access any of the CKFinder files (even when you point browser directly to that file), which is exactly what HTTP authentication does.

Do you authenticate in any way users that access FCKeditor?

Wiktor Walc
CTO, CKSource - http://cksource.com
--
Follow CKEditor on: Twitter | Facebook | Google+

Fri, 09/05/2008 - 11:01

creativ

Joined: 04/09/2008

Posts: 5

Re: ckfinder autorisation and htaccess

ive got a folger called web. in that folder is the next folder called FCK. in that fck folder is my htaccess. so, i did what you said, i set the authentification to true. if anyone wants to go to the FCK files via browser, he has to login because of the htaccess. so, it seems to work well. is it a good solution? or is it a wrong way to secure the functionality of FCK?

for everyone whos interested: the picture upload folder (mostly "userfiles") has to be outside the FCK folder, because of the htaccess. when its in that folder, everytime when you show pictures on frontend, it will ask for login.

so thanks for your help!

Fri, 09/05/2008 - 11:21

wiktor

Joined: 16/07/2007

Posts: 1641

Re: ckfinder autorisation and htaccess

If FCKeditor is secured with .htaccess and CKFinder is inside of FCKeditor folder, then everything is ok.
If CKFinder is outside of FCKeditor folder, you must put there a similar .htaccess file that will restrict access to CKFinder directory.

To be more secure, you may change the body of CheckAuthentication() to something like:

return isset($_SERVER['PHP_AUTH_USER']) && $_SERVER['PHP_AUTH_USER'] == 'mylogin';

Wiktor Walc
CTO, CKSource - http://cksource.com
--
Follow CKEditor on: Twitter | Facebook | Google+

Fri, 09/05/2008 - 11:36

creativ

Joined: 04/09/2008

Posts: 5

Re: ckfinder autorisation and htaccess

ok, thank you. yes, ckfinder is in that fck folder.

thanks for your help. i dont who created that tool, but its brilliant. thanks for such a tool!

regards