Basic PHP Password System for gbAudioPlayer

Change the app’s settings page path to a file named passcheck.php. settings.php will no longer be directly accessible and will be blocked by the web server. This ensures that all requests to grab settings.php are handled only when the server allows it and the proper checks have passed.

passcheck.php will see if a password for the current _idMember exists. If not, prompt for the user’s new password.

The new password will be sent over POST (with SSL/HTTPS enabled) and scrambled using a seed or encryption key to ensure that server administrators cannot read it. The encryption needs to be irreversible, since the key will be stored by the server and can therefore be read. This will happen every time a password is sent. If a password exists, passcheck.php will return the contents of settings.php.

settings.php will be altered accordingly; the big blue Submit button will now trigger a Javascript <div> dialog box inside of the same form, asking for the password for confirmation. The same scrambling method will be used when sent.

bmAudioSubmit.php will run the scrambler and determine if the password matches. If it does, continue as normal. If it does not, then redirect back to settings.php with this at the end of the url:

?checkfailed=true

This will tell settings.php that the password was incorrect and it will spit out an error message to let the user know.