I was recently asked to create a quick solution for a Web site that needed to allow each guest invited by snail mail to enter a unique access code on a Web site to access a registration form for an event. The reason for not using name/password access control was that the organizers wanted to keep it as simple as possible for the guests and felt that having them enter just one number would be the best plan.
The access code scheme we devised consisted of five-digit numbers where the first four digits were sequential (1001, 1002, and so on) while the final digit was a check digit (the check digit made it somewhat harder for an access code to be guessed or the wrong code entered by mistake – actually the probability of guessing or accidentally entering a valid access code was fractionally less than 1 in 200).
Anyway, generating these codes was done with a simple Excel spreadsheet which was then saved as a plain text file that was given to the folks printing the invitations.
The worst moments in network security history
So, had we been using normal access control it would have been easy enough to generate a .htaccess file. As we weren’t, we needed some code to achieve the goal.
What we didn’t want was anything complex which meant no SQL backend to store user names and passwords (a technique used by most of the login systems we looked at).
After a bit of research we found Micro Login System v1.0. This open source, PHP-based login system, which uses a simple flat file to store the login data, can be found on a number of script sites such as DreamCSS. There is absolutely no information on who created this script but whoever it was, thanks!
To install this system you simply unpack the distribution ZIP file into a subdirectory on your Web server.
The script supports registration, login, and logout functions and stores names and passwords in a file named “userpwd.txt” (it is vitally important, at least if you have any desire for this system to be private, to make the password file inaccessible; usually this is done by using .htaccess to protect the file).
The format of the password file is simple; each line consists of a registered user name, a colon as a separator, and the nd5 hash of the user’s password:
user_name:md5_hash_of_password
For our purposes we simply created a userpwd.txt file using the invitee access codes as the user names and nothing else on each line (what we actually did was just take the file we gave to the people printing the invites and rename it) and then modified the script in the file common.php commenting out lines 52 and 55:
// User exists, check password
// if (trim($tmp[1]) == trim(md5($pass))){
$validUser= true;
$_SESSION[‘userName’] = $user;
// }
If the user name (in our case, the access code) exists in the userpwd.txt file then this modification will ignore the test to see if the md5 hash value of the entered password matches stored md5 hash value.
We extracted the logic from the login script, added it to our home page, and then deleted the index.html, login.php, registration.php and logout.php files in the Micro Login System subdirectory.
Another aspect of this system we created was that the registration form reused the user’s login name (access code) as a hidden field in the form allowing the organizers to check if the registrant was indeed the invitee.
Voilà! A simple, workable access control system with a very low overhead and adequate security. We actually spent more time finding Micro Login System than modifying and implementing it!
The whole system would have worked fine except, as is often the case, the organizers changed their minds about how guests were to register so it was never used in anger. Even so, I have another useful tool in my toolbox …
If you have any useful hacks like this one, please let me know.
