My solution goes like this:-
1. Configure your favourite web server to deny access to "/admin" for HTTP clients. Allow everything for HTTPS clients. Also set up a Basic Authentication password file as a pre-login step for all HTTPS connections, so that the PHP admin code is not accessible to the great unwashed.
Now just to add to the complication, I happen to use a webserver with no HTTPS functionality. This means I must use a wrapper such as Stunnel to handle SSL encryption & decryption. So, there's no actual HTTPS as far as the web server is concerned - just an extra HTTP server instance on a different port on the loopback interface. (This has implications for URI processing later. The diffs I'm about to give you work either way.) The same kind of thing would apply if you used an SSL accelerator hardware box.
2. Implement these diffs, to make admin login and logout revolve around two new config.php parameters: admin_url and admin_login_url :-
Code: Select all
# diff config.php.ORIG config.php
33a34,37
> // Added by Martin:
> $config['admin_url'] = 'https://www.example.com/admin/index.php';
> $config['admin_login_url'] = 'https://www.example.com/admin/login.php';
>
# diff /admin/login.php.ORIG /admin/login.php
123c123,124
< redirect("index.php");
---
> // redirect("index.php"); Edited by Martin
> redirect($config["admin_url"]);
# diff logout.php.ORIG logout.php
43c43,44
< redirect("login.php");
---
> // redirect("login.php"); Edited by Martin
> redirect($config["admin_login_url"]);
# diff page.functions.php.ORIG page.functions.php
64,65c64,68
< $_SESSION["redirect_url"] = $_SERVER["REQUEST_URI"];
< redirect($config["root_url"]."/".$config['admin_dir']."/login.php");
---
> // Edited by Martin.
> // $_SESSION["redirect_url"] = $_SERVER["REQUEST_URI"];
> // redirect($config["root_url"]."/".$config['admin_dir']."/login.php");
> $_SESSION["redirect_url"] = $config['admin_url'] ;
> redirect($config["admin_login_url"]);
70,71c73,77
< $_SESSION["redirect_url"] = $_SERVER["REQUEST_URI"];
< redirect($config["root_url"]."/".$config['admin_dir']."/login.php");
---
> // Edited by Martin.
> // $_SESSION["redirect_url"] = $_SERVER["REQUEST_URI"];
> // redirect($config["root_url"]."/".$config['admin_dir']."/login.php");
> $_SESSION["redirect_url"] = $config['admin_url'] ;
> redirect($config["admin_login_url"]);
Cheers!
- Martin.
