0

I can't get Safari to submit forms to a page that is protected by .htaccess.
I have reduced my test page to:

<html>
<body>

<?php
  if(isset($_REQUEST["name"]))
     echo "<p>You entered: ", $_REQUEST["name"], "</p>";
?>

  <form method='post' action='index.php'>
  <p><input type='text' NAME='name'>
     <input type='submit' name='send' value='Send'></p>
  </form>

</body>
</html>

If I remove the .htaccess file the above page runs without any problem.
With this .htaccess file Safari will never finish loading the page:

AuthUserFile /xxxx/xxxx/.htpasswd
AuthGroupFile /xxxx/xxxx/.htgroup
AuthName Members
AuthType Basic

<Limit GET POST>
  require group XXXXX
</Limit>

ErrorDocument 401 /errors/401.php

Is there a workaround for this problem?

Update

I can remove the POST limitation in the .htaccess file:

<Limit GET>
  require group XXXXX
</Limit>

This will work for the above test case, but I won't be logged in anymore which means that:

  1. I don't have access to $_SERVER["PHP_AUTH_USER"]
  2. I have a security hole

Any ideas?

Update 2

I have added a missing line in the .htaccess file above (ErrorDocument 401 /errors/401.php) and made a personal reminder to always include everything in the samples (I'm supposed to know this). Helped by the comments from Marie Fischer it turns out that:

Safari will not be able to submit a form to a page that is protected by .htaccess (which limits POST) if the .htaccess file includes an ErrorDocument like:

ErrorDocument 401 /errors/401.php

2 Answers 2

1

Does your example work with other browsers? Does it work with require user instead of group? Have you looked at your servers error log?

Edit: I did a quick test using your examples and everything worked fine.

3
  • It works with IE, Firefox and Chrome 2 on Windows. Firefox on Mac works occasionally. No difference between require group and require user. I haven't found anything special in the server logs. Commented Jul 21, 2009 at 10:30
  • How about Safari on Windows? If you are having problems on Macs, then have you tried completely closing the browser (the little red dot won't do, choose quit from the menu) and making a fresh start? Commented Jul 21, 2009 at 10:48
  • Thank you for the testing. I made me pursue this even further... see solution to the problem above. I have been testing on Safari Windows. Commented Jul 21, 2009 at 10:58
0

What if you make the HTTP authentication on the page where you have the form? Then you are logged in and it should work. Or?

1
  • Probably - it would require rethinking the security issues. Commented Jul 21, 2009 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.