htaccess Hack for the CP of your vB Version 2.2.4 - English Version

[Afterburner]

Maybe you know it, there where a lot of hacking attacks to the cp of some vB boards.

With this hack you can protect your board with a .htaccess password protection.

Now you can set the .htaccess password protection in the right frame of your CP (Control Panel Home)

to disable the potection delete the .htaccess and the .htpasswd file


PS: sorry for my terrible English ;)

Screenshot:

https://vborg.vbsupport.ru/

[vertex]

nice hack but i dont need it = ]

[Floris]

Thank you :)
Do you know if this works with slash/plesk servers ?

[Afterburner]

if its an UNIX sytem an the system is correct configured it works, plesk is only an interface not the operating system

[Jawelin]

Very nice hack.... I found it very useful tu avoid editing the .htaccess file outside the server administration control panel... :nervous:

But I can't manage to make it working... ;)

Actually, the function you use to hash password within the .htaccess file, $passwortverschluesselt = crypt($HTTP_POST_VARS[passwort]); doesn't match with my server's algorithm. So I always get 'wrong pw error'.
I'm on a Linux / Apache server...

I saw you don't use the salt key... Hwr as you can see on http://www.php.net/crypt (http://www.php.net/manual/en/function.crypt.php) manual, to create an .htaccess compatible hash is suggested to use the first two chars of the pw as salt:

//To generate a .htaccess-based authentication with DES,
// you have to use the first two characters of your password as salt.

$pass = "something";
$ht_pass = crypt($pass,substr($pass,0,2));


It doesn't work too on my server.
I create the htaccess file with an Apache cpanel and got an hash. When trying the crypt() algorithm with different salts, I can't manage to obtain the same hash... :cross-eyed:

Thanks

[captainandy]

Thank you :)
Do you know if this works with slash/plesk servers ?

With Plesk - you can go to your domain.name and go to the icon that says "Directories"... it will allow you to set that kind of access without doing the hack here. just pick the directory - then give it a username and password... and you are done....