Zikula Community

• **unknown user**
  
  

  • Rank: Registered User
  • Registered: Mar 16, 2002
  • Last visit: Jan 31, 2004
  • Posts: 43

  Posted: Jan 29, 2004 - 01:45 PM

  Perhaps this has been asked before; I haven't found reference to it.
  
  I want to use Postnuke as the base of an Ecommerce site, for which I want to hire a PHP coder to design, etc.
  
  One of my concerns is "separation of church and state" in that I would feel safer if I could keep the administrative functions external of the primary page base. Even a separate URL altogether.
  
  This may be contrary to Postnuke's design, however.
  
  I figured I would post here and see what input anyone had on this topic.
  
  And rentacoder.com is "okay" -- there must be other sites.
  
  
  Thanks!

  • 
  •  
• **unknown user**
  
  

  • Rank: Helper
  • Registered: Mar 16, 2002
  • Last visit: Oct 21, 2009
  • Posts: 712

  Posted: Jan 30, 2004 - 05:03 AM

  Hi Forrie,
  
  I tried to write a long response, and the sytem settings timed me out. Grrr....
  
  In "short form" the Administration of PN is already separated. Only those with Admin level permissions can access them. I "think" you have probably used a locally loaded version and have become confused by the "Administration" link showing up when you log in. Try registering as a normal user and you will see it that link has disappeared. (At least that is how the default setup is configured).
  
  Hope my assumptions are on-target and this helps you.
  
  Warm Regards,
  -=dave=-

  • 
  •  
• **unknown user**
  
  

  • Rank: Registered User
  • Registered: Mar 16, 2002
  • Last visit: Jan 31, 2004
  • Posts: 43

  Posted: Jan 30, 2004 - 05:08 AM

  Sorry about the timeout - I've had that happen...
  
  I should have been more clear about what I was thinking. One idea was to not have the admin user log in through the front-end... but to have the administrative functions totally moved to another URL, that you could restrict in various ways.
  
  This would be good from a security perspective, I would think, if there weren't any possible privileged actions you could take from the front-end.
  
  
  
  Forrest

  • 
  •  
• markwest
  
  

  • Rank: Team Member
  • Registered: Mar 18, 2002
  • Last visit: Oct 21, 2009
  • Posts: 6606

  Posted: Jan 30, 2004 - 12:39 PM

  Thats from a user perspective... From a developer perspecive then the admin functions are already seperated. While the URL may not be different (this is actually irrelevant) the admin functions of all pnAPI compliant modules are already seperated. A module contains the files pnadmin.php and pnadminapi.php; these form the admin interface and are totally inaccessable to the average user.
  
  -Mark
  
  --
  Visit My homepage and Zikula themes.

  • 
  •  
• **unknown user**
  
  

  • Rank: Registered User
  • Registered: Mar 16, 2002
  • Last visit: Jan 31, 2004
  • Posts: 43

  Posted: Jan 30, 2004 - 06:38 PM

  Okay, further I think I had in mind not allowing an "admin" user to log in through the front-end interface... somehow creating a "back end" URL that could be further restricted.

  • 
  •  
• markwest
  
  

  • Rank: Team Member
  • Registered: Mar 18, 2002
  • Last visit: Oct 21, 2009
  • Posts: 6606

  Posted: Jan 31, 2004 - 12:01 AM

  That would break the concept of the permissions system within PN. Under your setup (which is the way PHP-nuke works) then your either an admin or not. With PN permissions you can devolve control of certain areas or modules to trusted people. While your site may not need that its a requirement that many PN users have.
  
  -Mark
  
  --
  Visit My homepage and Zikula themes.

  • 
  •  
• **unknown user**
  
  

  • Rank: Registered User
  • Registered: Mar 16, 2002
  • Last visit: Jan 31, 2004
  • Posts: 43

  Posted: Jan 31, 2004 - 05:53 AM

  I see. I wonder, though, if there may be a way to tweak it such that access to certain accounts can be restricted... allowed from only certain IP space, etc. That seems like a reasonable compromise here.
  
  I think it's a bad idea to enable access to admin from the front page - what happens if there's an exploit? If the admin page is hosted elsewhere, restricted by firewall filters, it will certainly be more secure. But I digress

  • 
  •  
• HalbrookTech
  
  

  • Rank: Developer
  • Registered: Dec 31, 1969
  • Last visit: Jun 01, 2010
  • Posts: 6859

  Posted: Jan 31, 2004 - 06:42 AM

  PostNuke, when the modules are well coded, is pretty secure, and they are quick to fix security issues when they do arrise. What you are proposing would require a rewrite, not only to PostNuke itself, but to every module you want to use. PostNuke is not designed for the type of security you want to use.
  
  --
  Home Page | Find on Facebook | Follow on Twitter
  

  • 
  •  
•  
•  

Users on-line

• alfonsomarin,
• damon

This list is based on users active over the last 60 minutes.