Organizr: Homepage accessible directly without authentication

[mattman86]

If you go to http://[IP Address:Port]/homepage.php, the homepage comes up fine without asking for any authentication.

[causefx]

correct, as it is still beta. I will be adding options for each segment to lock down.

[StevenChorkley]

Is there a way to introduce auth support with homepage.php in nginx for the time-being?

Something like:

location /homepage.php {
        auth_request /auth-admin;
}

[causefx]

location ^~/homepage.php {

                #Organizr auth check                    
                auth_request /auth-admin;                

                location ~ \.php$ {
                    #Change to you php config
                    include snippets/fastcgi-php.conf;
                    fastcgi_pass unix:/run/php/php7.0-fpm.sock;

                }

        }

[StevenChorkley]

And that's why you're the developer, and I'm not!
Thanks man!!

[trancefam]

Now that I have everything set up, I also implemented the above code for check.php. Working great - thanks causefx

[kendokan]

It might be better to put auth_request under the server block and use a pattern whitelist instead.

server {
    auth_request /auth-admin;

    location ~* (^\/bower_components\/|^\/css\/|^\/images\/|^\/js\/|^\/lang\/) {
        auth_request off;
    }

    location ~* (^\/$|^\/index\.php$|^\/error\.php$) {
        # your php config here
        auth_request off;
    }
}

[Cerothen]

Implemented in https://github.com/causefx/Organizr/commit/7795f4a2341e976e7ab36b5f8f36999389819d54

[zenxedo]

I am having trouble getting this to work with lsiocommunity/organizr docker. I don't think php-fpm is setup correctly or even installed fastcgi_pass unix:/run/php/php7.0-fpm.sock; do i need this line for auth to work correctly? I have tried multiple different ways with my nignx config from other posts. I get 500 errors on the pages when auth is enabled so I guess it's not reading the file correctly. The dashboard will download as a file sometimes instead of opening.

[Cerothen]

To use the implemented homepage authentication you would need to use the full "Cero-dev" branch.

Once you do you will have an option that looks like this in the settings:

[StevenChorkley]

what are the differences between the two branches? Will they eventually be merged?

[Cerothen]

Yup, for the last 2-3 versions cero-dev is the formal development branch. @causefx has just been busy with work lately and I don't want to merge his project. That being said we are always looking for people to test the development branch before it goes officially live.

[StevenChorkley]

Is @causefx snippet now required with the cero-dev branch?

[zenxedo]

I'm getting this after switching to cero-dev Notice: Use of undefined constant HOMEPAGECUSTOMHTML1 - assumed 'HOMEPAGECUSTOMHTML1' in /config/www/Dashboard/homepage.php on line 333 along with others like this for the other tabs.

[Cerothen]

can you post the as many of the errors as possible (or the web server error log) in a new issue for this?

Thanks,

[zenxedo]

posted, let me know if you need anything else. Do you think it's something on my end?