ALBUM SECURITY
--------------

Last Updated: 17-May-2000

MAIN ALBUM

You have two options to secure your album:

  1. Using your web server's access control mechanism.
  2. If your web server supports it, the photo album itself can handle the
     password security for you.

Option 1 requires that you consult the documentation for your web server.  The
most popular web servers out there use a .htaccess file created in the main
directory for the album (the one containing all the .php3 files).  Other web
servers may have a completely different means to control security.

Option 2 might not work with all web servers.  At the present time, I know it
works with Apache using the mod_php3 module.  I have no information about any
other server configuration.  The advantage of option 2 is that you can allow
users with valid cookies to bypass the password mechanism.  See the file
constants.php3 for more details regarding this configuration.


ADMIN SECTION

The admin section of the album is the interface you will use to control many
aspects of the photo album.  It is very important the you and only you have
access to the admin section.  You have two options to control access:

  1. Using your web servers access control mechanism.
  2. Using admin cookies provided by the photo album.

If you choose option 1, you need to create a .htaccess file or equivalent to
either set a password for the admin section or protect is based on source IP
address.  See your web server's documentation for more details.  If you setup
option 1, you need to edit the file admin/constants.php3 and set:

  $access_read = true;
  $access_full = true;

For option 2, first note the following lines in admin/constants.php3:

  $access_read = false;
  $access_full = false;

Read-only access is only useful if you have some sort of online-demo of the
photo album and admin interface setup (such as I have on sourceforge.net).
I strongly recommend against public read-only access for all normal uses of
this album.  

For option 2 you will want both of the above settings to be false once you
have the album configured.  The way you grant access to the admin interface
for yourself is by creating a cookie for yourself and setting it to an admin
cookie.  Follow the following procedure:

1. Make sure your browser has a cookie for you.  Entering the photo album and
setting your preferences is the best way to do it.  If you have preferences
disabled, you need to add a caption to a photo to get a cookie.  If you have
not yet installed the database tables needed by the album, you may want to skip
to step 2 below first.  Make sure you get your database tables setup and all of
these steps are complete as quick as possible (to make sure no one discovers
your album before the security is in place).

2. Set both of the above $access_* settings to true.

3. Enter the admin interface and go to the cookies section.  Find your cookie
(by either noting your name or IP address) and set it to an admin cookie.

4. Change both of the above $access_* settings back to false.

You should now find that your browser has access to the admin section as long
as it remembers its cookie.  All other browsers should get an access denied
message.  Ideally, you should perform steps 2 to 4 as quickly as possible.

