stopplidelsen/innhold
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enhance publiser password management tool

Browse source 
Add support for multiple users in the password utility. New
features allow listing existing users and removing specific users
from the `.htpasswd` file without overwriting others.
This commit is contained in:
Ruben 2026-08-30 22:24:16 +02:00
parent 747e730366
commit 6525b561c2
2 changed files with 59 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

65
custom/tools/set-publiser-password.php
View file

@ -1,14 +1,18 @@
#!/usr/bin/env php
<?php
/**
* Set or reset the Basic Auth login for /publiser.
* Add, update, or remove a Basic Auth login for /publiser.
*
* Writes a bcrypt-hashed .htpasswd file (no dependency on the `htpasswd`
* binary being installed - Apache's mod_authn_file accepts $2y$ hashes).
* Writes bcrypt-hashed entries to .htpasswd (no dependency on the
* `htpasswd` binary being installed - Apache's mod_authn_file accepts
* $2y$ hashes). Existing users are preserved: re-running with a known
* username updates just that line, any other username is appended.
*
* Usage:
* php custom/tools/set-publiser-password.php <username> <password>
* php custom/tools/set-publiser-password.php (interactive)
* php custom/tools/set-publiser-password.php --remove <username>
* php custom/tools/set-publiser-password.php --list
*/
$htpasswdPath = dirname(__DIR__, 2) . '/content/publiser/.htpasswd';
@ -31,8 +35,50 @@ function promptHidden(string $question): string {
return $value;
}
function readUsers(string $path): array {
if (!is_file($path)) return [];
$users = [];
foreach (file($path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) ?: [] as $line) {
[$user, $hash] = array_pad(explode(':', $line, 2), 2, '');
if ($user !== '') $users[$user] = $hash;
}
return $users;
}
function writeUsers(string $path, array $users): void {
$lines = [];
foreach ($users as $user => $hash) {
$lines[] = "$user:$hash";
}
file_put_contents($path, $lines ? implode("\n", $lines) . "\n" : '');
// World-readable: the web server user (www-data, varies by host/container)
// needs read access. This is safe - Apache denies direct HTTP access to
// this exact filename (content/publiser/.htaccess), and reaching it any
// other way already requires shell/filesystem access to the server.
chmod($path, 0644);
}
$args = array_slice($argv, 1);
if (($args[0] ?? '') === '--list') {
$users = array_keys(readUsers($htpasswdPath));
echo $users ? implode("\n", $users) . "\n" : "No users configured yet.\n";
exit(0);
}
if (($args[0] ?? '') === '--remove') {
$username = $args[1] ?? prompt('Username to remove: ');
$users = readUsers($htpasswdPath);
if (!isset($users[$username])) {
fwrite(STDERR, "No such user: $username\n");
exit(1);
}
unset($users[$username]);
writeUsers($htpasswdPath, $users);
echo "Removed \"$username\". " . count($users) . " user(s) remain.\n";
exit(0);
}
$username = $args[0] ?? prompt('Username: ');
$password = $args[1] ?? promptHidden('Password: ');
@ -46,12 +92,9 @@ if (str_contains($username, ':')) {
exit(1);
}
$hash = password_hash($password, PASSWORD_BCRYPT);
file_put_contents($htpasswdPath, "$username:$hash\n");
// World-readable: the web server user (www-data, varies by host/container)
// needs read access. This is safe - Apache denies direct HTTP access to
// this exact filename (content/publiser/.htaccess), and reaching it any
// other way already requires shell/filesystem access to the server.
chmod($htpasswdPath, 0644);
$users = readUsers($htpasswdPath);
$isNew = !isset($users[$username]);
$users[$username] = password_hash($password, PASSWORD_BCRYPT);
writeUsers($htpasswdPath, $users);
echo "Wrote $htpasswdPath for user \"$username\".\n";
echo ($isNew ? 'Added' : 'Updated') . " \"$username\". " . count($users) . " user(s) total in $htpasswdPath.\n";