php - 与 suPHP 一起实现登录

Question

如何将类似登录的功能设计为使用 suPHP 的文件权限。例如，如果我在 www.example.com 有一个网站，下面的两个用户有自己的主目录，每个用户都有一个 php 脚本 test.php，和一个validateUser.php 属于 /home 目录中另一个用户(root、www-data、apache...)的脚本。

/home/├── validateUser.php├── user1│   └── test.php└── user2    └── test.php

user1 can access user2's script by visiting www.example.com/user2/test.php, and vice versa. Instead what I want, is to channel all incoming requests, using something like mod_rewrite, to validateUser.php. However, doing so will have the consequence of executing all scripts as the owner of validateUser.php, not the target test.php script.

Is there anyway to call a php script before suPHP kicks in, and then either allow suPHP to continue, or abort entirely.

---

EDIT This is the second bounty I am putting up. The first I gave to Gustav b/c he gave a good partial answer. I will mention what I have attempted so far, and why none of them work for me.

1)I have tried using mod_rewrite to redirect the URL to validateUser.php to either log the user in, or call whatever script they wanted to call. The problem is that I have set my virtual hosts such that each user has their own virtual site (ie. www.user1.example.com, www.user2.example.com...if this is a bad design approach, feel free to rudely point it out). Therefore, although the OS sees the file structure as above, online, the root directories are set up as such

VirtualHost = www.user1.example.com
├── validateUser.php
└── test.php
VirtualHost = www.user2.example.com
├── validateUser.php
└── test.php

当然，我只是将 validateUser.php 的副本移动到每个用户的目录中。问题是现在用户可以删除那个文件并把他们想要的任何东西放在那里，就像根本不需要登录一样。解决此问题的一种方法是使主文件夹具有粘性(这不是我推荐对主文件夹执行的操作)并使 validateUser.php 归根所有。但现在它将作为 root 执行，因为这是 suPHP。那就是我放弃的地方。

2) 我可以使用 Gustav 的 mod_auth 建议，但我不喜欢它要求预先输入密码(就像老式网站一样)。

3) 如果我可以在虚拟主机之间重定向，我已经考虑过 1) 的变体。例如，像这样重组虚拟主机

VirtualHost = www.user1.example.com
└── test.php
VirtualHost = www.user2.example.com
└── test.php
VirtualHost = www.admin.example.com
└── validateUser.php

然后使用 mod_rewrite 将用户的所有流量重定向到 www.admin.example.com/validateUser.php，如果用户已登录(或登录成功)，则用户是重定向回他们最初尝试登录的站点。这样做的好处是，如果可能的话，suPHP 不会启动，直到用户被引导回他们自己的虚拟主机。

Answer 1

您是否考虑过使用 mod_auth 来实现用户身份验证？ ？如果您决定尝试一下，有一个 guide您可能会觉得有用。

Apache 2.2 等价物:

• mod_auth_basic
• Authentication HOWTO

请注意，浏览器存储凭据，并在您发出的每个请求的 header 中发送它们。