lighttpd forum XCache > using xcache admin auth interferes with apps

I'm currently developing an app in symfony. I just switched over from 
eaccel. to xCache based on findings that it is superior.  I like the 
admin info page that you can use to see how much the cache is working 
and what is getting cached.  Here's the thing.  The whole php.ini set 
user/pass is totally annoying.  If I set it on, then any app that would 
call xcache_ functions will invoke the htaccess auth call.  Symfony 
calls xcache_clear in its cache process class.  If I turn it off, I 
can't monitor my cache.  Why don't you just get rid of the php.ini set 
auth for admin and let users set htaccess as they want/need . I would 
like to have my cake and eat it too.

  public static function clear()
  {
    switch (self::cacher())
    {
.
.
      case 'xcache':
        for ($i = 0, $max = xcache_count(XC_TYPE_VAR); $i < $max; $i++)
        {
          if (!xcache_clear_cache(XC_TYPE_VAR, $i))
          {
            return false;
          }
        }
        return true;
.
.
    }

    return false;
  }

noel wrote:
> I'm currently developing an app in symfony. I just switched over from 
> eaccel. to xCache based on findings that it is superior.  I like the 
> admin info page that you can use to see how much the cache is working 
> and what is getting cached.  Here's the thing.  The whole php.ini set 
> user/pass is totally annoying.  If I set it on, then any app that would 
> call xcache_ functions will invoke the htaccess auth call.  Symfony 
> calls xcache_clear in its cache process class.  If I turn it off, I 
> can't monitor my cache.  Why don't you just get rid of the php.ini set 
> auth for admin and let users set htaccess as they want/need . I would 
> like to have my cake and eat it too.
> 
>   public static function clear()
>   {
>     switch (self::cacher())
>     {
> .
> .
>       case 'xcache':
>         for ($i = 0, $max = xcache_count(XC_TYPE_VAR); $i < $max; $i++)
>         {
>           if (!xcache_clear_cache(XC_TYPE_VAR, $i))
>           {
>             return false;
>           }
>         }
>         return true;
> .
> .
>     }
> 
>     return false;
>   }

this is a bug in symfony I was going to report, but I forgot about it.

plz if you can report this problem to Fabian saying that you cannot
clear the Xcache variable cache in an anonymous way.

> can't monitor my cache.  Why don't you just get rid of the php.ini set 
> auth for admin and let users set htaccess as they want/need . I would 
> like to have my cake and eat it too.
this is for security.

if you tune if off and allow every single page to access these admin 
functions, any vhost user can do so and see all the php file path etc, 
leaking security informations.

there is example to workaround it in admin/config.php.example

just set user/pass in both ini and config, so your script can 
passthrough it