Download the PHP package sayamaapps/kirby-sudare without Composer

On this page you can find all versions of the php package sayamaapps/kirby-sudare. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of sayamaapps/kirby-sudare

Informations about the package kirby-sudare

Sudare

Preview protection for Kirby CMS sites before launch.

Sudare puts HTTP Basic Auth in front of a Kirby site, adds noindex to its responses, and serves the files under media/ and assets/ through PHP, so they sit behind the same password. It runs before Kirby boots, and no route gets past it: not the Panel, not the API, not an error page. Without a configuration, it does nothing.

Features

Requirements

Installation

The package is a Composer library, not a Kirby plugin. It installs to vendor/sayamaapps/kirby-sudare/; deploy vendor/ as you deploy kirby/.

Setup

  1. public/index.php: call the guard before Kirby. Print nothing before it, not even a BOM. Keep Kirby's api.basicAuth off, or the Sudare login is taken as an API login.

    The complete file is examples/index.php.

  2. public/.htaccess: route media/ and assets/ through index.php, and keep the two authentication lines. See examples/htaccess.txt.

    Keep other static files out of public/: Apache serves them without Sudare.

  3. Configuration: sudare-hash asks for the password (at least 8 characters, at most 72 bytes) and prints the file to standard output. Keep site/config/sudare.php out of Git.

    Under opcache.validate_timestamps=0 or opcache.restrict_api, add the file to opcache.blacklist_filename. With restrict_api, a changed password otherwise counts only when opcache revalidates; sudare-check warns about that.

  4. Deploy: store the file's content as the secret SUDARE_PHP, write it to site/config/sudare.php in the deploy job, and gate the upload with vendor/bin/sudare-check. It exits 1 when there is no configuration or it is switched off, and 2 when it is broken. The public deploy runs vendor/bin/sudare-check --allow-off instead: a missing configuration passes, a broken one still fails. The check reads the files; --env also counts the SUDARE_* variables of the job.

    After the first deploy, request an existing media file without credentials. The answer must be 401. A front server that serves files itself bypasses Sudare, and no check can see that.

Usage

Machine token

The configuration keeps only the hash. Store the plain token as a CI secret.

Exempt paths

For a webhook from an outside service:

An exempt path is open to everyone, so keep entries as narrow as the endpoint. /.well-known/acme-challenge is always exempt.

Calls

Call Meaning
Sudare\Sudare::guard($base) Decides, sends the headers, and exits unless the request passes.
Sudare\Sudare::active() true when this request is behind the protection (after guard()).
Sudare\Sudare::protects($base) Stateless: would guard($base) protect? Reads files and this process's environment only.
Sudare\Sudare::config() The loaded configuration, or null.
Sudare\Sudare::translations() The package's strings as sudare.* keys, for a site plugin to register.
sudare_option($key, $default) A non-secret option. hash and token are never returned.

Translations

The 401 page, the 503 text and the CLI messages come in English and German. Sudare::translations() returns them as sudare.* keys; Sudare cannot register them itself, because it runs before Kirby.

Options

Keys are sudare.<key> (flat), 'sudare' => [...] (nested) or bare in site/config/sudare.php; a flat key beats a nested one, which beats a bare one. null and an empty string mean "not set". Environment variables are laid over the file per key, and without any file they can configure Sudare on their own. If sudare.php is absent, the legacy site/config/credentials.php (a vorschau array) is read.

Key Env Default Meaning
active SUDARE_ACTIVE true when a source exists false parks the configuration and the site is open. A typo makes it broken, never open.
user SUDARE_USER — Basic Auth user name: non-empty, no :, no control characters.
hash SUDARE_HASH — password_hash() output (bcrypt or Argon2), never the plain password. A damaged or template hash makes the configuration broken.
realm SUDARE_REALM Preview (Vorschau in the legacy file) Text of the browser's login dialog.
token SUDARE_TOKEN — Hash of a machine token (see Machine token).
exempt SUDARE_EXEMPT [] Paths that pass without credentials: /path, /path/*, optionally with a method. Comma-separated in the environment.
language SUDARE_LANGUAGE en (de in the legacy file) en or de for the 401 page, the 503 text and the default realm.
theme — built-in palette Colours of the 401 page: chrome (browser theme colour), paper, ink, deep, text; #rgb, #rrggbb or #rrggbbaa. File only.
media SUDARE_MEDIA true Serve media/ through PHP. false leaves it to Kirby.
assets SUDARE_ASSETS true Serve assets/ through PHP. false leaves it to Kirby.

The theme defaults are #1E3648 (chrome), #FFFFFF (paper), #15222B (ink), #1E3648 (deep) and #41505A (text). Under a Content-Security-Policy with style-src 'self', the 401 page's colours need the hash that sudare-check prints.

Privacy

Sudare processes no visitor data: no cookies, no browser storage, no requests to third parties.

Maintenance

Tests: composer test. Issues and pull requests are welcome, without a support promise. Report security problems privately through GitHub's vulnerability reporting. Changes: CHANGELOG.md.

License

MIT, see LICENSE.

All versions of kirby-sudare with dependencies

PHP Build Version
Package Version
Requires php Version ^8.2
ext-mbstring Version *
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package sayamaapps/kirby-sudare contains the following files

Loading the files please wait ...