0

Hi I have secured my folders on my web site with CPanel. CPanel has its own folder protection built into the admin console. I also have a separate login system that uses php. I.e. user registers email and password which is hashed and then saved in MySqlDB. With this they have access to all files at root level / or folders not secured by cpanel. Folders off the root that I require elevated rights to access are locked by cpanel.

I would like to know how to bypass the cpanel security if my user is approved without adding their access manually into cpanel for cpanel secured folder. I.e. if approved this user would have been elevated by webmaster and can now have access to secured folder / locked by cpanel. By elevation I mean there is a tick entered manually into database that elevates user. I.e. 1 means elevated and 0 not. Elevated users will therefore have access to all cpanel secured folders even thought they are not created in cpanel / given rights in cpanel.

Note that access via php with registration system is automatic and managed by the user while cpanel access must be manually entered for each folder via a pop up Name and Password box. Obviously automatic registration by user and manual rights added to a folder will never be the same. From the answers I have received it appears: 1. I must build all access into php and use a database. 2. Only use CPanel folder security for php classes etc. that I want secured as php bypasses the cpanel httaccess security.

Does anyone know how I can use php to restrict access to my stuff in a sub folder at folder level to all except users who I have manually elevated to the rights needed to access the folder. I will do this directly on the database by changing a flag against their name. I.e. how do I use php to mirror the cpanel folder security.

Mark Corrigan
  • 1
  • 2
  • 1
    What do you mean by you **secured them using CPanel**? – Spoody Jan 19 '18 at 16:40
  • 1
    My guess is that the OP used cpanel to setup .htaccess security (`.htpasswd` files). OP: I would suggest that you work towards making the whole process database driven, and not rely on .htaccess password protection. It's more flexible, more controllable, and, if done correctly, more [secure](https://stackoverflow.com/questions/6441578/how-secure-is-htaccess-password-protection). The problem that you're describing is one minor reason why mixing authentication methods is rarely a good thing. – RToyo Jan 19 '18 at 16:47
  • So... you have to enter a username and password to enter a folder, right? I think it's way better to do this using a class, you can create a Session class to store all data you might need and then use it to check for permissions. If the requirements are not met, redirect them to somewhere else or print a message, whatever you want. I only password protect folders where I'm saving PHP classes, PHP management files, etc... whenever a PHP file wants to use those resources, it's ok since it's an internal process. But if you try to enter directly, you're prompted to enter a password. That's neat. – Zeke Jan 19 '18 at 16:52

0 Answers0