MIG AND PASSWORDS

DISCLAIMER

Note: this password scheme is not 100% secure! It's probably not even 90% secure. Anyone who really wants to get to your images can get around this protection by viewing the source of the page they are viewing and going to image URLs directly and such. As such you shouldn't use this if you really need your images to be protected. I hope to fix this security problem in a future version of Mig but right now this is just the way it is.

PASSWORD PROTECTION

You may want to protect some folders from being viewed by the public. You can do this by assigning usernames and passwords for access control to particular folders.

To do this, add lines like this one to your config.php file:

    $protect['./Example_Gallery']['joe'] = 'IBDXWbkBirMfU';

The part in the first set of []'s is the directory. The second set of []'s contains the username. The part in '' at the end is the password, in unix crypt() format.

The directory name is the value of currDir as seen in any URL when you go to that folder. Some examples might be:

    ./Example_Gallery
    ./People/Stephanie
    ./Trips/Europe

The password protection includes subfolders - so if you have a Trips/Europe folder, and it contains many subfolders, they will also have the same password protection properties.

Note that if you have a defined password policy for say Trips/Europe/Belgium, it will override Trips or Trips/Europe. The rule is simple - the most specific definition wins. Or, one could say the longest folder name wins.

A more complete example might be something like this:

    $protect['./People/Stephanie']['dan']      = 'NI6kjeu0Bu5OA';
    $protect['./People/Stephanie']['kate']     = 'BSkfNxImwPHeQ';
    $protect['./People/Stephanie']['mom']      = 'IGSQpYrjm0znM';
    $protect['./Trips/Europe/Belgium']['joe']  = 'NLmqM5pt3s6Xc';
    $protect['./Trips/Europe']['fig']          = 'RRElq4KBFcLhk';

It is important to use only the currDir string you want. Do not add a trailing slash, and do not omit any characters at the end. Do not omit the leading ./ either.

So if you have currDir=./People/Stephanie, use ./People/Stephanie and not People/Stephanie or ./People/Stephanie/.

CRYPT FORMAT

But wait! How do I generate unix crypt() format passwords?

Well, you can do it like this in PHP:

    <?php
        $pass = 'somepassword';
        $salt = 'Ai';
        print crypt($pass, $salt);
    ?>

The salt is any two-character combination - it is used to seed the random generation process, so to speak. Any two characters are good enough (but you can't use ``:'' (colon) in a salt).

If you have access to Perl somewhere (most of us do), you can also find a script in the contrib directory that will generate crypt format passwords for you. Here's the URL to that script:

    http://tangledhelix.com/software/mig/downloads/contrib/crypt

HOW DO I PROTECT THE MAIN LEVEL ('currDir=.') ?

You could set up an .htaccess file in Apache, or the equivalent mechanism for your server, on your gallery base directory.

If you want to do it using Mig's own password scheme, just set something like this:

    $protect['.']['kate'] = 'BSkfNxImwPHeQ';