[GH-ISSUE #536] Improvement suggestion - simple pluggable and overridable user auth #394

New issue

Closed

opened 2026-03-02 15:58:25 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 15:58:25 +03:00

Owner

Originally created by @acerbis on GitHub (May 3, 2021).
Original GitHub issue: https://github.com/prasathmani/tinyfilemanager/issues/536

Thanks for the project.
You already include "config.php" by default, that allows the user to specify custom parameters (and this survives a new file manager release).
Would be extremely useful to be able to specify there, in the config.php, if needed, a custom function to authenticate the user and provide various flags on how to handle the user, all in a centralized point.
So in config.php one can specify a user-specialized function (instead of the default) in a simple and straightforward way.

$TINY_AUTH = myautfunction

so in the code you can call $TINY_AUTH($user, $pass)

the function could have this signature

function($user, $pass) {
... ... ...
$ret = array( 'auth' => 'OK' , 'readonly' => 'yes', 'limitedtothisdir' => '/home/myuser' , 'theme' => 'mytheme', 'allowzipping' => true ....)
return $ret

it would be nice

Originally created by @acerbis on GitHub (May 3, 2021). Original GitHub issue: https://github.com/prasathmani/tinyfilemanager/issues/536 Thanks for the project. You already include "config.php" by default, that allows the user to specify custom parameters (and this survives a new file manager release). Would be extremely useful to be able to specify there, in the config.php, if needed, a custom function to authenticate the user and provide various flags on how to handle the user, all in a centralized point. So in config.php one can specify a user-specialized function (instead of the default) in a simple and straightforward way. $TINY_AUTH = myautfunction so in the code you can call $TINY_AUTH($user, $pass) the function could have this signature function($user, $pass) { ... ... ... $ret = array( 'auth' => 'OK' , 'readonly' => 'yes', 'limitedtothisdir' => '/home/myuser' , 'theme' => 'mytheme', 'allowzipping' => true ....) return $ret it would be nice

kerem

2026-03-02 15:58:25 +03:00

closed this issue
added the
Feature
label

kerem commented

2026-03-02 15:58:26 +03:00

Author

Owner

@acerbis commented on GitHub (May 3, 2021):

Basically, you can have in tinymanager.php something like at beginning

$TINY_AUTH_DEF = function($user, $pass) use (&$auth_users) {
  return password_verify($pass, $auth_users[$user]);
};
$TINY_AUTH = $TINY_AUTH_DEF;

and then modify the authentication part as

if(function_exists('password_verify')) {
            if (isset($auth_users[$_POST['fm_usr']]) && isset($_POST['fm_pwd']) && $TINY_AUTH($_POST['fm_usr'], $_POST['fm_pwd'])) {

that can work as a drop in replacement for the current code and keep the overall simplicity.

if one wishes, one can change $TINY_AUTH in included config.php to specify a custom function.

This can be implemented with interfaces etc. but I like this simple functional style in line with the overall fileman spirit.

Future improvements:
$TINY_AUTH can, instead of returning a boolean, return a full array with many user parameters (authenticated?, homedir, readonly , theme, open for extension...etc.etc.)

@acerbis commented on GitHub (May 3, 2021): Basically, you can have in tinymanager.php something like at beginning ``` $TINY_AUTH_DEF = function($user, $pass) use (&$auth_users) { return password_verify($pass, $auth_users[$user]); }; $TINY_AUTH = $TINY_AUTH_DEF; ``` and then modify the authentication part as ``` if(function_exists('password_verify')) { if (isset($auth_users[$_POST['fm_usr']]) && isset($_POST['fm_pwd']) && $TINY_AUTH($_POST['fm_usr'], $_POST['fm_pwd'])) { ``` that can work as a drop in replacement for the current code and keep the overall simplicity. if one wishes, one can change $TINY_AUTH in included config.php to specify a custom function. This can be implemented with interfaces etc. but I like this simple functional style in line with the overall fileman spirit. Future improvements: $TINY_AUTH can, instead of returning a boolean, return a full array with many user parameters (authenticated?, homedir, readonly , theme, open for extension...etc.etc.)

kerem commented

2026-03-02 15:58:26 +03:00

Author

Owner

@prasathmani commented on GitHub (May 3, 2021):

@acerbis thank you for your valuable input.

@prasathmani commented on GitHub (May 3, 2021): @acerbis thank you for your valuable input.