--- docman.php	2000/12/21 08:46:18	1.27
+++ docman.php	2001/01/26 12:39:57	1.30
@@ -51,7 +51,7 @@
 	deleted files!
 
 	.htusers is in form:
-	login:Real Name:md5(loginpassword)
+	login:Real Name:[md5(loginpassword)|auth_*]:email@host.dom
 
 
 TODO:
@@ -75,41 +75,46 @@
 
 // 	error_reporting(4) ;		// how verbose ?
 
+	// from where to include auth_*.php modules?
+	$gblIncDir = "/home/httpd/docman";
+
 	// username/password should not be system 
 	// usernames/passwords !!
 
-//	$gblPw    = "hash_of_your_username_and_password" ;
-
-//	$gblAuth  = false ;             // use builtin authentication
-	$gblAuth  = true ;             // use builtin authentication
-        $gblHash  = "md5" ;             // hash function to use
-
 	$gblPw    = "";
 
-	if ($gblAuth) {
-		$htusers_file=dirname($SCRIPT_FILENAME)."/.htusers";
-		if (! file_exists($htusers_file)) {
-			$htusers=fopen($htusers_file,"a+");
-			fputs($htusers,"# Change owner of $htusers_file to root !!\n");
-			fputs($htusers,"demo:full name:md5_hash\n");
-			fclose($htusers);
-		}
-		$htusers=fopen($htusers_file,"r");
-		while($user = fgetcsv($htusers,255,":")) {
-			if ($user[0] == $GLOBALS["PHP_AUTH_USER"]) {
-				$gblUserName=$user[1];
-				$gblPw=$user[2];
-				$gblEmail=$user[3];
-				continue ;
+	$htusers_file=dirname($SCRIPT_FILENAME)."/.htusers";
+	if (! file_exists($htusers_file)) {
+		$htusers=fopen($htusers_file,"a+");
+		fputs($htusers,"# Change owner of $htusers_file to root !!\n");
+		fputs($htusers,"demo:full name:[md5_hash|auth_*]:e-mail\n");
+		fclose($htusers);
+	}
+	$htusers=fopen($htusers_file,"r");
+	while($user = fgetcsv($htusers,255,":")) {
+		if ($user[0] == $GLOBALS["PHP_AUTH_USER"]) {
+			$gblUserName=$user[1];
+			$gblPw=$user[2];
+			if (substr($gblPw,0,5) == "auth_" && file_exists("$gblIncDir/$gblPw.php")) {
+				require("$gblIncDir/$gblPw.php");
+				if ($gblPw($user)) {
+					$gblPw=md5($PHP_AUTH_USER.$PHP_AUTH_PW);
+				} else {
+					$gblPw="error".md5($PHP_AUTH_USER.$PHP_AUTH_PW);
+				}
 			}
+			$gblEmail=$user[3];
+			continue ;
 		}
-		fclose($htusers);
 	}
+	fclose($htusers);
 
+	// date format
 //	$gblDateFmt="D, F d, Y";
-//	$gblTimeFmt="g:i:sA";
-
 	$gblDateFmt="Y-m-d";
+
+	// time format
+//	$gblTimeFmt="g:i:sA";
 	$gblTimeFmt="H:i:s";
 
 	// Number of backup files to keep
@@ -121,12 +126,12 @@
 	// choose GifIcon below unless you have the M$
 	// WingDings font installed on your system
 
-	$gblIcon = "GifIcon" ;		// MockIcon or GifIcon
+	$gblIcon="GifIcon";		// MockIcon or GifIcon
 
 	// the directory below should be /icons/ or /icons/small/ 
 	// on Apache; a set of icons is included in the distribution
 
-	$gblIconLocation = "/icons/" ; 
+	$gblIconLocation="/icons/"; 
 
 	// files you want to be able to edit in text mode
 	// and view with (primitive) syntax highlighting
@@ -145,7 +150,7 @@
 
 function StartHTML($title,$text="") {
 
-	$title = "Site Manager " . $title ;
+	$title = "Document Manager " . $title ;
 	$host  = $GLOBALS["HTTP_HOST"] ;
 	$self  = $GLOBALS["PHP_SELF"] ;
 ?>
@@ -376,7 +381,7 @@
 		while ($e = array_shift($logarr)) {
 			if (strstr($e[4],"upload")) {
 				if (file_exists("$bakdir/$bakcount/$name")) {
-					$e[4]="<a href=\"".dirname($relPath)."/.bak/$bakcount/$name\">$e[4]</a>";
+					$e[4]="<a href=\"".urlpath(dirname($relPath)."/.bak/$bakcount/$name")."\">$e[4]</a>";
 				}
 				$bakcount++;
 			}
@@ -920,29 +925,6 @@
 
 //////////////////////////////////////////////////////////////////
 
-function CreateHash($user, $pw) {
-
-	global $gblHash ;  // hash function to use 
-
-	if ($user == "" || $pw == "") {
-		$text = "either no password or no username supplied" ;
-		Error("Create Hash",$text) ;
-	}
-	$title = "(Create Hash)" ;
-	StartHTML($title) ;
-	echo "<P ALIGN=center>" ;
-	echo "<BLOCKQUOTE>Copy the value below and paste it " ;
-	echo "into the<BR>value for \$gblPw in the source of " ;
-	echo "this file<BR><BR><B>" . $gblHash($user.$pw) ;
-	echo "</B><BR><BR>Hash function: " . $gblHash ;
-	echo "</BLOCKQUOTE></P>" ;
-	EndHTML() ;
-	exit ;
-
-} // end function CreateHash
-
-//////////////////////////////////////////////////////////////////
-
 function NoEntry() {
 
 	$user = $GLOBALS["PHP_AUTH_USER"] ;
@@ -952,20 +934,7 @@
 	$title = "(401 Unauthorized)" ;
 	$text  = "No trespassing !" ;
 	StartHTML($title,$text) ;
-?>
 
-<FORM ACTION="<?= $self ?>?HASH=create" METHOD="POST">
-<INPUT TYPE="HIDDEN" NAME="USER" VALUE="<?= $user ?>">
-<INPUT TYPE="HIDDEN" NAME="PW" VALUE="<?= $pw ?>">
-
-<BLOCKQUOTE><B>If you are a site administrator:</B><BR><BR>
-Click below to <B>generate a password hash</B><BR>from 
-the username-password pair you just<BR>entered. Then include the hash in 
-the source<BR>of this file.<BR><BR>
-<INPUT TYPE="SUBMIT" VALUE="CREATE HASH">
-</BLOCKQUOTE></FORM>
-
-<?php
 	EndHTML() ;
 	exit ;
 }
@@ -1179,13 +1148,9 @@
 	// forks before authentication: style sheet and hash
 	// creation if password not yet set.
 	if ($STYLE == "get") { CSS() ; exit ; }
-	if ($HASH != "") { 
-		CreateHash($USER, $PW) ; 
-		exit ; 
-	}
 
-	// authentication if $gblAuth == true
-	if ( $gblAuth && $gblHash($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw ||
+	// authentication failure
+	if ( md5($PHP_AUTH_USER.$PHP_AUTH_PW) != $gblPw ||
 		isset($relogin) && $gblPw == $relogin ) {
 		header("WWW-authenticate: basic realm=\"$HTTP_HOST\"") ;
 		header("HTTP/1.0 401 Unauthorized") ;