Search code examples
.htaccesssecuritymodel-view-controlleradministration

.htaccess to secure admin directory in mvc architecture

I am trying to make a site with mvc structure. I have this :

  • www/

    • blog/

      • app/
        • admin/
          • controller/
          • model/
          • view/
        • config/
        • front/
          • controller/
          • model/
          • view/
      • assets/
      • images/
      • libs/

    • portfolio /

I have a first .htaccess at the root (www/) for Gzip compression and stuff. I have a second .htaccess for my blog (in www/blog/) with my very basic redirection system :

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
#QSA permet de garder les paramètres GET et les ajouter à la suite
RewriteRule (.*) index.php?p=$1 [QSA]

The file index.php in www/blog/ parses the url and uses the right controllers like this :

//****************************************************

include_once(APP_f.controller/controller.class.php');
$controlF = new ControleurF();

include_once(APP_b.'controleur/controleur.class.php');
$controlB = new ControleurB();


if (isset($_GET['p'])&&(substr($_GET['p'],0,4)== 'admin')) {
//on est dans l'admin
    $lapage=explode('/',$_GET['p']);
    if (!empty($lapage[1])) {$pp = $lapage[1];} else {$pp="index";}

    if (!isset($pp) OR $pp == 'index')
    { 
        $ctrl = "home"; $p = $ctrl;
    } else { 
        $params = explode('/',$pp); 
        $ctrl = $params[0]; $p = $ctrl;
        if (isset($params[1])) { 
            if ($params[1]<>"") {$p = $params[1];} 
        }   
    }

    $c=$controlB->load($ctrl);
    include_once($c);

}else{
//on est en front
    if (!isset($_GET['p']) OR $_GET['p'] == 'index')
    { 
        $ctrl = "home"; $p = $ctrl;
    } else { 
        $params = explode('/',$_GET['p']); 
        $ctrl = $params[0]; $p = $ctrl;
        if (isset($params[1])) { 
            if ($params[1]<>"") {$p = $params[1];} 
        }   
    }

    $c=$controlF->load($ctrl);
    include_once($c);
}

//****************************************************

Everything works fine but i am having trouble understanding how i could secure my admin folder with .htaccess/.htpasswd Is there a way to do something like that in www/blog/.htaccess :

<Directory admin>
AuthUserFile "/home/foobar/www/blog/.htpasswd"
AuthGroupFile /dev/null
AuthName "Admin"
AuthType Basic
Require valid-user
</Directory>
Solution

  • I find a way : use sessions with php http://www.apprendre-php.com/tutoriels/tutoriel-14-les-sessions.html