update for info text after installation

[realsobek]

After installation of JournalTouch 0.4.1 on CentOS 7 x86_64 I noticed the messages near the top on orange background at:
http://journaltouch/
The messages read:
You are using JournalTouch with demo settings. Head over to Settings to set up you own configuration.
and
The admin folder is not secured by an .htaccess file. Anyone has access. Just rename admin/.htaccess.sample to .htaccess if you don't care and want to disable this message.

From my point of view, the surplus empty spaces at end of both lines should be removed.

For the second line I would change the wording from:
The admin folder is not secured by an .htaccess file. Anyone has access. Just rename admin/.htaccess.sample to .htaccess if you don't care and want to disable this message.
to:
Anyone seems to have access to the admin area. Just create admin/.htaccess, if you want to disable this message.

For unknown reasons admin/.htaccess with content (I replaced IP address with a dummy):
require ip 1.2.3.4
did not work out for me. Even after a restart. Everyone had access. Hence I solved it this way:
cat > "/opt/rh/httpd24/root/etc/httpd/conf.d/journaltouch.conf" << EOF
<VirtualHost *:80>
DocumentRoot "/opt/rh/httpd24/root/var/www/html/bibliocoll-JournalTouch-869729f"
</VirtualHost>
<Directory "/opt/rh/httpd24/root/var/www/html/bibliocoll-JournalTouch-869729f/admin/">
Options Indexes FollowSymLinks MultiViews
AllowOverride all
Require local
Require ip 1.2.3.4
</Directory>
EOF

[krugar]

1. yea

2. it would probably make sense to add a link to the apache documentation regarding .htaccess files here. people using other web servers (ie: nginx) have to improvise here anways.
   aside: imho, JournalTouch is not yet fit for open-internet use, regardless of how the admin page is secured (because of the whole "javascript-based cart to server-side email"-thing).

3. i'm not familiar with centos' default apache config, but i'm assuming it is configured to ignore .htaccess files in subdirectories?

[realsobek]

2. http://httpd.apache.org/docs/current/mod/core.html#allowoverride seems to be a good starting point; it links to https://httpd.apache.org/docs/current/howto/htaccess.html

3. indeed, 'AllowOverride None' was in place; 'AllowOverride All' worked out

[krugar]

damn, forgot about this before pushing 0.4.2 out the door. this goes into the next round :S