Secure PHP Development- P43 pdf

$thisApp = new userManagerApparray ‘app_name’ => $APPLICATION_NAME, ‘app_version’ => ‘1.0.0’, ‘app_type’ => ‘WEB’, ‘app_db_url’ => $APP_DB_URL, ‘app_auto_authorize’ => FALSE, ‘app_auto_c

$thisApp = new userManagerApp(

array( ‘app_name’ => $APPLICATION_NAME,

‘app_version’ => ‘1.0.0’,

‘app_type’ => ‘WEB’,

‘app_db_url’ => $APP_DB_URL,

‘app_auto_authorize’ => FALSE,

‘app_auto_connect’ => TRUE,

‘app_auto_chk_session’ => FALSE,

‘app_debugger’ => $ON )

);

//$thisApp->buffer_debugging();

$thisApp->run();

//$thisApp->dump_debuginfo();

?>

Configuring user administration applications

The user manager application and all the other applications in the user manage-ment system require configuration information that is stored in user_mngr.conf Table 6-2 shows the configuration settings.

TABLE6-2 USER MANAGER CONFIGURATION

$PEAR_DIR Set to the directory containing the PEAR

package; specifically the DB module needed for class.DBI.phpin our application framework.

$PHPLIB_DIR Set to the PHPLIB directory, which contains the

PHPLIB packages; specifically the template.

incpackage needed for template manipulation.

$APP_FRAMEWORK_DIR Set to our application framework directory.

Continued

TABLE6-2 USER MANAGER CONFIGURATION (Continued)

$PATH Set to the combined directory path consisting of

the $PEAR_DIR, the $PHPLIB_DIR, and the

$APP_FRAMEWORK_DIR This path is used with the ini_set()method to redefine the php.inientry for include_pathto include

$PATHahead of the default path This allows PHP to find our application framework, PHPLIB, and PEAR-related files.

$AUTHENTICATION_URL Set to the central login application URL.

$LOGOUT_URL Set to the central logout application URL.

$APPLICATION_NAME The internal name of the application.

$DEFAULT_LANGUAGE Set to the default (two character) language

code.

$DEFAULT_DOMAIN Set to the default domain of the user This

domain is appended when the user does not specify the fully qualified username (user@host) during interaction with the user management applications.

$ROOT_PATH Set to the parent directory within the Web

server’s document root where the user-manager-specific directory exists as a subdirectory.

$REL_APP_PATH The relative application path as seen from Web

browser.

$TEMPLATE_DIR Set to the template directory containing the

ihtml template files needed for the user management applications.

$CLASS_DIR Set to the class directory where

user-management-related class files are stored.

$USER_CLASS Fully qualified pathname for the User class.

$MIN_USERNAME_SIZE Minimum user name (EMAIL) size.

$MIN_PASSWORD_SIZE Minimum password size.

Variable Purpose

$DUMMY_PASSWD Dummy password used during account

modification step.

$ROOT_USER Fully qualified username of the root user

generation, which is used when forgotten password URL links are sent via e-mail.

$CHAR_SET Default character set to be used in e-mail

content type header.

$USERMNGR_MNGR Name of the user manager application.

$USERMNGR_FORGOTTEN_APP Name of the forgotten password application.

$USERMNGR_CHANGE_PWD_APP Name of the change password application.

$REL_TEMPLATE_DIR Relative path to the template directory as seen

from the Web.

$APP_DB_URL The fully qualified database URL needed to

access the user database.

$STATUS_TEMPLATE Name of the status information display

template.

$USERMNGR_MENU_TEMPLATE Name of the user management menu template.

$USERMNGR_USER_TEMPLATE Name of the user add/modify form template.

$USERMNGR_PWD_REQUEST_TEMPLATE Name of the password change template.

$USERMNGR_PWD_EMAIL_TEMPLATE Name of the e-mail template, which is used to

send the e-mail message for forgotten passwords.

$USERMNGR_PWD_RESET_TEMPLATE Name of the forgotten password reset template.

$USERMNGR_PWD_CHANGE_TEMPLATE Name of the password change template.

$ADMINISTRATIVE_USER Numeric type value for administrative user.

$STANDARD_USER Numeric type value for standard user.

$USER_TYPE Associative array defining the relationship

between the numeric user type and user type labels.

Listing 6-3 shows the configuration file (user_mngr.conf).

Listing 6-3: user_mngr.conf

<?php

// Turn on all error reporting error_reporting(E_ALL);

// If you have installed framework directory in // a different directory than

// %DocumentRoot%/framework, change the setting below

$APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] ‘/framework’;

$PEAR =$_SERVER[‘DOCUMENT_ROOT’] ‘/pear’;

$PHPLIB =$_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’;

// Insert the path in the PHP include_path so that PHP // looks for PEAR, PHPLIB and our application framework // classes in these directories

ini_set( ‘include_path’, ‘:’

$PEAR ‘:’

$PHPLIB ‘:’

$APP_FRAMEWORK_DIR ‘:’ ini_get(‘include_path’));

$AUTHENTICATION_URL = “/login/login.php”;

$LOGOUT_URL = “/logout/logout.php”;

$APP_MENU = ‘/home/home.php’;

$APPLICATION_NAME = ‘USER_MNGR’;

$XMAILER_ID = ‘Example User Manager Version 1.0’;

$DEFAULT_LANGUAGE = ‘US’;

$DEFAULT_DOMAIN = ‘example.com’;

$ROOT_PATH = $_SERVER[‘DOCUMENT_ROOT’];

$REL_ROOT_PATH = ‘/user_mngr’;

$REL_APP_PATH = $REL_ROOT_PATH ‘/apps’;

$TEMPLATE_DIR = $ROOT_PATH $REL_APP_PATH ‘/templates’;

$CLASS_DIR = $ROOT_PATH $REL_APP_PATH ‘/class’;

$REL_TEMPLATE_DIR = $REL_APP_PATH ‘/templates/’;

require_once “user_mngr.errors”;

require_once “user_mngr.messages”;

require_once ‘DB.php’;

require_once $APP_FRAMEWORK_DIR ‘/’ ‘constants.php’;

require_once $APP_FRAMEWORK_DIR ‘/’ $APPLICATION_CLASS;

require_once $APP_FRAMEWORK_DIR ‘/’ $ERROR_HANDLER_CLASS;

require_once $APP_FRAMEWORK_DIR ‘/’ $AUTHENTICATION_CLASS;

require_once $APP_FRAMEWORK_DIR ‘/’ $DBI_CLASS;

require_once $APP_FRAMEWORK_DIR ‘/’ $USER_CLASS;

require_once $TEMPLATE_CLASS;

$MIN_USERNAME_SIZE= 3;

$MIN_PASSWORD_SIZE= 3;

$DUMMY_PASSWD = ‘1234567890’;

$ROOT_USER = ‘kabir@evoknow.com’;

$SECRET = 916489;

$CHAR_SET = ‘charset=iso-8859-1’;

// Application names

$USERMNGR_MNGR = ‘user_mngr.php’;

$USERMNGR_FORGOTTEN_APP = ‘user_mngr_forgotten_pwd.php’;

$USERMNGR_CHANGE_PWD_APP = ‘user_mngr_passwd.php’;

/* -START TABLE NAMES - */

$APP_DB_URL = ‘mysql://root:foobar@localhost/auth’;

$AUTH_DB_TBL = ‘users’;

/* -END TABLE NAMES - */

$STATUS_TEMPLATE = ‘usermngr_status.html’;

$USERMNGR_MENU_TEMPLATE = ‘usermngr_menu.html’;

$USERMNGR_USER_TEMPLATE = ‘usermngr_user_form.html’;

$USERMNGR_PWD_REQUEST_TEMPLATE= ‘usermngr_forgotten_pwd.html’;

$USERMNGR_PWD_EMAIL_TEMPLATE = ‘usermngr_forgotten_pwd_email.html’;

$USERMNGR_PWD_RESET_TEMPLATE = ‘usermngr_pwd_reset.html’;

$USERMNGR_PWD_CHANGE_TEMPLATE = ‘usermngr_pwd_change.html’;

$ADMINISTRATIVE_USER = 9;

$STANDARD_USER = 1;

$USER_TYPE = array(‘9’ => ‘Administrator’, ‘1’ => ‘Standard User’);

?>

Make sure you change this file to adjust the file and directory path information

as needed