'Statistics Page Password' have no effect

[crossing]

'Statistics Page Password' set have no effect and everyone can access my stats.

[chrisf]

Did you reset httpd after you changed the password?   I will test as well.

[crossing]

I reboot it the server with no results.

[chrisf]

Mustafa, there is a bug / problem with stats password now.  Servers that had password protection already, it works.  On new installs or new domains the password stays null.  I tried both templates, feather and default (6.5.0f 20140103).  If I try to change an existing password it sets it to null.

So the problem is not with httpd, but with setting the actual passwords in KloxoMR.   Please fix, this is actually a security bug.

Thank you

[MRatWork]

Look like something wrong with mechanism to save password and create __stats file.

[chrisf]

I don't know when it stopped working.  Please advise, a fix here is important.

[MRatWork]

Still investigate for this issue.

[crossing]

Mustafa did you managed to fix this bug ?

[crossing]

Any chance to fix this problem ? I have one competitor keep accesing stats page.

[MRatWork]

Temporary solution:

For apache, copy domains.conf.tpl to custom.conf.tpl and then modified:

Code: [Select]

<?php
            if ($statsprotect) {
?>

    <Location "/awstats/">
        AuthType Basic
        AuthName "Awstats"
        #AuthUserFile "/home/<?php echo $user; ?>/__dirprotect/__stats"
        AuthUserFile "/home/httpd/<?php echo $domainname ?>/__dirprotect/__stats"
        require valid-user
    </Location>
<?php
            }
to:

Code: [Select]

<?php
            //if ($statsprotect) {
?>

    <Location "/awstats/">
        AuthType Basic
        AuthName "Awstats"
        #AuthUserFile "/home/<?php echo $user; ?>/__dirprotect/__stats"
        AuthUserFile "/home/httpd/<?php echo $domainname ?>/__dirprotect/__stats"
        require valid-user
    </Location>
<?php
            //}
the same trick for nginx and lighttpd.

With this trick no one able to access to stats (including you) except knowing username and password.

[MRatWork]

Above code for awstats. Find out also for webalizer.

[chrisf]

Mustafa, this is not a good solution.  Clients want to password protect stats.  How do they set password? KloxoMR not allowing setting of password.  This worked in previous versions of KloxoMR, as my older sites have it enabled,

Please fix the panel way, so clients can use.

[chrisf]

Mustafa any progress on fixing this issue?

[chrisf]

There has been three KloxoMR updates since this issue was discovered.  Mustafa, please fix this.

[crossing]

Any news about this problem ?