Sebastian Mendel a écrit :
Hi,
how about fall back to cookie or http auth if config auth fails?
would make it more easy to run phpMyAdmin out of the box (at least for
localhost)
but only if config is set to root without password
if config_auth_fail, user == 'root', pw == ''
than switch to cookie auth
and display message about it
I would prefer to remove "config" auth. Now that we require cookie
support in browser, I don't see any advantage for "config" auth, only
security issues because their user/password in the file, which requires
protection on the web-server level and protection from spies on a shared
server.
Setup script already generates a blowfish secret.
Our config sample uses "cookie" auth as default.
Marc
objection again ;)
i have all my pma versions in a .htaccess protected folder and normally use
"config" auth
("cookie" only for testing/reproducing error reports).
But i suggest to use "http" in config.default insted of "config"
(cookie would be even better, but requires a unique "blowfish" secret).
just my 2 euro cent
--
View this message in context: