Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
#1 2009-11-28 21:12:15
- tennapel
- Member
- Registered: 2009-05-31
- Posts: 62
Standard function in TXP for a challenge/response on TXp users?
I’m developing a plugin that needs a login form. I want to use the TXP users (the users that can log in on the admin side). I want to check a username and password entered in the form against the username/password combo in the TXP database.
I have been looking around on Google and in the TXP php files, but cannot find a standard function in TXP/lib that you can use to check the username/password combo and that will return either ‘good / no good’ or the username and privs.
How can I do this most secure? I prefer to hook into a TXP lib function if possible.
Last edited by tennapel (2009-11-28 21:13:17)
Offline
Re: Standard function in TXP for a challenge/response on TXp users?
Hi
Have you tried to see ign_password_protect code, i think you can find the answer there.
Cheers
Offline
#3 2009-11-29 11:19:04
- tennapel
- Member
- Registered: 2009-05-31
- Posts: 62
Re: Standard function in TXP for a challenge/response on TXp users?
I found the function ‘txp_validate($user,$password)’ in txp_auth.php in the folder ‘include’ of the textpattern folder. Is that safe to call from a plugin?
Offline
#4 2009-12-01 08:35:13
- tennapel
- Member
- Registered: 2009-05-31
- Posts: 62
Re: Standard function in TXP for a challenge/response on TXp users?
No one has an answer to this?
Offline
Re: Standard function in TXP for a challenge/response on TXp users?
You shouldn’t use that directly.
Offline
#6 2009-12-01 21:17:39
- tennapel
- Member
- Registered: 2009-05-31
- Posts: 62
Re: Standard function in TXP for a challenge/response on TXp users?
Ok, if not, what other option is there to authenticate against the TXP users in de database and keep it safe?
Offline
Re: Standard function in TXP for a challenge/response on TXp users?
Sorry, but I’m not sure why you wouldn’t use ign_password_protect. If there was additional functionality you need, this plugin can also work with a couple of others but you could at least use it as a starting point and then hack your way around whatever else you need.
Offline
Re: Standard function in TXP for a challenge/response on TXp users?
There is no other option. Calling txp_validate directly bypasses the delays that are added in other places to make brute-force attacks less interesting. Look at how txp_validate is used in TXP code and you’ll see what I mean. So, you can use it directly, if you use it in a similar way as TXP core does.
Offline
#9 2009-12-03 14:23:37
- tennapel
- Member
- Registered: 2009-05-31
- Posts: 62
Re: Standard function in TXP for a challenge/response on TXp users?
ok, thanks ruud, i will look at the txp_validate example.
@aslsw66: ign_password_protect does not work on the servers of the webhost for reasons I don’t know; writing my own solution gives me a little more flexibility in output.
Offline
Re: Standard function in TXP for a challenge/response on TXp users?
That’s weird! My usual approach to the flexibility with output issue is to just start hacking into someone else’s plugin. I call it “standing on the shoulders of giants” – it sounds better than “hacking”.
Offline
#11 2009-12-03 16:27:59
- tennapel
- Member
- Registered: 2009-05-31
- Posts: 62
Re: Standard function in TXP for a challenge/response on TXp users?
I tried hacking into ign_password_protect, but it was too much code to spot the problem. Also, authentication is directly against the database, so security wise I’m not sure that’s the best way (see other topic). I’d like to tap into the textpattern authentication itself.
Offline