bigdoggy59 Posted July 19, 2010 Share Posted July 19, 2010 Environment: Web site hosted on a Linux box. Using CPanel's File Manager to password-protect a folder for our Sales group. Problem: One of our sales guys logged into the Sales area, opened a report, then clicked "send as e-mail" to a customer. The customer receives the e-mail, gets a popup asking for username and password (as it should be). She clicks "Cancel" then gets to see the report anyway (not good). She tries again and intentionally fails the log in - and gets to see the report anyway (even more not good). Then I get notified. Question: Is there any way in PHP to keep a password-protected page from being accessed from an e-mail? Do I need to ignore the File Manager and build (or use) a PHP authentication class? Honestly, I didn't realize this was a security risk until now and would like to plug it before someone decides to send something more dangerous than a price sheet. Link to comment https://forums.phpfreaks.com/topic/208132-block-e-mail-request-for-web-page/ Share on other sites More sharing options...
trq Posted July 19, 2010 Share Posted July 19, 2010 Is there any way in PHP to keep a password-protected page from being accessed from an e-mail? From email or not. Sounds like your password protection isn't working. Emails simply contain links which when clicked on make a http request for the resource. Link to comment https://forums.phpfreaks.com/topic/208132-block-e-mail-request-for-web-page/#findComment-1087954 Share on other sites More sharing options...
bigdoggy59 Posted July 19, 2010 Author Share Posted July 19, 2010 From email or not. Sounds like your password protection isn't working. Emails simply contain links which when clicked on make a http request for the resource. Until this situation occurred, I'd have said the same thing. What's odd is that if you try to go to the page directly and don't log in, you get a 403-Access Denied. When the page has been sent as e-mail, it still asks for the password, but then shows the page whether a login is entered or not. Link to comment https://forums.phpfreaks.com/topic/208132-block-e-mail-request-for-web-page/#findComment-1087988 Share on other sites More sharing options...
trq Posted July 19, 2010 Share Posted July 19, 2010 Maybe the 'send as e-mail' option actually downloads and attaches the page to the email. If that is the case, its still out of your hands. Link to comment https://forums.phpfreaks.com/topic/208132-block-e-mail-request-for-web-page/#findComment-1087990 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.