I recently purchased the fileman.cgi ( mall version ). I would like the customers to be able to “set passwords” for their individual folders.. but the usernames/passwords
are all being added to “one” file.. so incidentally.. any user can access another’s “protected” directory since their username/pass is on the same list.

Example: User A has an account. They create a folder and set up a password protection on it. Everything is fine.
User B has an account. They go to create a folder and setup password protection on it. Suddenly they see someone else listed in the drop down list. They delete it.

User A now is not allowed access to their protected directory.. so they recreate a password.. but when they do.. they See User B listed. They delete it.

See the paradox? Is there anyway for the fileman.cgi to create a separate .htpasswd file inside the directory they are trying to protect? If it did, then this would solve this problem. Also, only the users listed in that one folder’s .htpasswd file would show in the drop down menu.

If this is a bug.. no problem.. I have disabled that feature. Hopefully you can get a fix on that one in the future. If there is something I am doing wrong.. please let me know.


Sincerely,

James Hart

Stormer Web Design
http://www.stormerwebdesign.com

Thats great! The problem was not so much allowing users to create passworded directories as it was if you had the "same directory" name and wanted to password protect it.

Did you manage to have the .htpasswd file created in the same directory as the .htaccess?

I would think showing those files to be minor, as you can see them in actual ftp also. Might be nice to be able to edit those on occasion as well. =)

I know Alex told me in a personal email he was working on a fix for this.. why not pass the good info up the chain of command? =)

James Hart

Yes, Currently all .htpasswd files are build with in the directory in which the .htaccess file is build it. The next step is to find out how to set noretreive switch on .files for an added level or security. email me rbrown@fpsn.net for the howto.

I to would like to figure out how to setup something along those lines. Currently I can create a link to build a .htaccess file under the root of the users directory. But with
no way to create unique values for the password file all the passwords get dropped into the same directory as .pass

Maybe re-coding the script to just create a .htpasswd file in each directory with the .htaccess file?

Update: After spending most of my night working on the script I managed to allow users to password protect there own directory, and any subdirectories, I guess the next step is to figure out a way to keep it from listing .<> files. ;-)