| Author |
 Topic  |
|
|
redbrad0
Advanced Member
USA
3725 Posts |
|
|
seven
Senior Member
USA
1037 Posts |
 Posted - 25 July 2004 : 21:00:17
|
| Would this not be similar to the NT features of Snitz? |
|
 |
|
|
pdrg
Support Moderator
United Kingdom
2897 Posts |
Posted - 26 July 2004 : 07:56:33
|
will multi users be sharing a u:p? What are they logging into? I'm guessing a snitz forum, so how would you differentiate between the users for postings/moderation etc if they didn't log in? Couldn't they just be guests?
This sounds like one of those questions that rings alarm bells in my head - usually if we go back to basics and find out exactly what you're trying to do and why, we can work out a different (and often better/easier) solution!
hth |
|
|
|
redbrad0
Advanced Member
USA
3725 Posts |
Posted - 28 July 2004 : 19:24:19
|
| Sorry for taking so long to respond but just been swamped. Basically I am working on a control panel that would just be for me and only has the things I want so I dont want to have to buy one. When the user logs into the control panel with their username/password (not NT) then to be able to call functions to create websites, users and other things it needs admin rights on the server. Hopefully that gives a idea. What I decided to do is just change in IIS the anon user to be a admin account just for the one directory. |
Brad
Oklahoma City Online Entertainment Guide
Oklahoma Event Tickets |
|
|
|
pdrg
Support Moderator
United Kingdom
2897 Posts |
Posted - 29 July 2004 : 06:22:10
|
OK, sounds like you've got a workaround, but does this mean you're implementing security by obscurity? If I find your directory, does that mean I'm admin? If so, please reconsider!
Another option would be to limit pages to a specific IP or IP range if you will just be using the one PC to work on. Not actually totally secure, but way better than giving iusr admin privs on a dir!
hth |
|
|
|
redbrad0
Advanced Member
USA
3725 Posts |
Posted - 29 July 2004 : 10:18:58
|
| Well all users will have full access to that directory once they log into the control panel. This is not live yet so I am in no harm of yet. From what I can tell this seems the way that 99% of the control panel's work just most people do not know this. If my login script stops the access to any of the pages except the login pages. |
Brad
Oklahoma City Online Entertainment Guide
Oklahoma Event Tickets |
|
|
|
pdrg
Support Moderator
United Kingdom
2897 Posts |
Posted - 02 August 2004 : 05:45:27
|
| Mate, I think security by obscurity is a baaaaad way to go - at least add a header into the page script checking the IP of the request, make it a little harder than just spidering your site to get control privs! |
|
|
| |
Topic |
|
Topic Locked
