Secure PHP Development- P47 pot

Chapter 7 Intranet System IN THIS CHAPTER ◆ Developing a base intranet-application ◆ Using login/logout information to generate access reports ◆ Developing a simple messaging application

/* -END TABLE NAMES - */

$STATUS_TEMPLATE = ‘usermngr_status.html’;

$USERMNGR_MENU_TEMPLATE = ‘usermngr_menu.html’;

$USERMNGR_USER_TEMPLATE = ‘usermngr_user_form.html’;

$USERMNGR_PWD_REQUEST_TEMPLATE= ‘usermngr_forgotten_pwd.html’;

$USERMNGR_PWD_EMAIL_TEMPLATE = ‘usermngr_forgotten_pwd_email.html’;

$USERMNGR_PWD_RESET_TEMPLATE = ‘usermngr_pwd_reset.html’;

$USERMNGR_PWD_CHANGE_TEMPLATE = ‘usermngr_pwd_change.html’;

$ADMINISTRATIVE_USER = 9;

$STANDARD_USER = 1;

$USER_TYPE = array(‘9’ => ‘Administrator’, ‘1’ => ‘Standard User’);

?>

To make it easy for users to reset forgotten passwords, you can add the forgotten-password application link in the login interface template Figure 6-7 shows such a login interface

Figure 6-7: Central login interface with forgotten-password link.

Testing the forgotten-password recovery application

To test the forgotten password application, simply click the forgotten-password link

on the login interface Submit a user’s e-mail address and wait for an e-mail to appear in the user’s mailbox Click on the link in the e-mail and change the password

(See Figure 6-8.) After you’ve changed the password, you can log in to any application that uses the central authentication system with the user’s name and the new password

Chapter 6: Central User Management System 201

Figure 6-8: Changing a password.

Summary

In this chapter I discussed how you can manage users using a central user manage-ment system consisting of a few applications This user managemanage-ment (create, mod-ify, delete and forgotten password support) system works with the central Login/Logout system previously developed in the earlier chapter

The very idea of having a central user authentication (login/logout) and a user management system is to ease user management and make access to various appli-cations as seamless as possible In the future chapters the appliappli-cations we will develop will simply rely on these systems

202 Part II: Developing Intranet Solutions

Chapter 7 Intranet System

IN THIS CHAPTER

◆ Developing a base intranet-application

◆ Using login/logout information to generate access reports

◆ Developing a simple messaging application

A BASE INTRANET APPLICATIONis an application which is used to provide a home page for each user This application shows links to other applications

In this chapter, we will develop the base intranet application that shows each user a home page When a user logs in, she sees a generated page with information, such as notes from other intranet users, or she can access other intranet tools that

we will build in later chapters

Identifying Functionality Requirements

The base intranet application system consists of the following features:

◆ A central user authentication and user management facility: We built

this in the first two chapters in this section of the book In this chapter, we will add a set of applications called Access Reporter, Admin Access Reporter, and Daily Logbook that will allow intranet users, administra-tions to access login/logout access information Each regular user will be allowed to access only her own access report while administrators will have full access to all user access report and summaries In a company environment, these access reports can serve as office attendance record

◆ A user home application: Each user should be able to log in and view a

dynamic home page that enables that user to access information and applications available on the intranet system The home application will have two small utilities to display tips and handle user preferences related

to screen themes

203

◆ A simple messaging application that enables users and administrators

to send messages in the form of notes: For example, a user should be

able to send a note via the intranet to another user about a task deadline

or a meeting We will implement this messaging tool, which we named here as the Message of the Day (MOTD) tool

◆ A simple document-publishing application that enables intranet users

to publish HTML documents in an organized manner: This tool enables

users to provide feedback to each posted document Also, whenever a new document is added or an existing one is updated, users who have access

to the document should be automatically notified via the messaging sys-tem previously mentioned The applications for this suite are built in Chapter 8

◆ A simple central contact-manager application that enables intranet users to access common contact information such as that for vendors, customers, partners, and co-workers: These applications are built in

Chapter 9

◆ A simple central event-calendar application suite that enables users to publish and view important events: These applications are built in

Chapter 10

◆ A simple Internet resource manager application suite that allows users

to share Internet resources such as Web and FTP sites: These

applica-tions are built in Chapter 10

The intranet applications that we develop here require the central login/logout and user-management components of the intranet discussed

in the previous three chapters in this section.

You’ll need to have those applications (login, logout, user-management) already implemented so that we can develop the base intranet home and access applications in this chapter.

Designing the Database

Since we are designing the intranet to support small to large number of users, we need a SQL server as the data storage Like previous chapters and rest of he book,

we will assume that you are going use MySQL for the database here as well The authentication database (auth) previously built for central authentication will still be used for storing user information such as username, password, active flag, and so on Here we will develop a database that stores intranet messages, user details, preferences, theme choices, and user-access activity log data

Figure 7-1 shows the database diagram for the intranet system

204 Part II: Developing Intranet Solutions

Figure 7-1: Intranet system ER diagram.

The users table is shown in the ER diagram to clarify the relationship It actu-ally does not belong in the INTRANET database but in the central user-authentication database called auth discussed in Chapter 5 Users who appear in the auth database in the users table have access to the intranet.

Table 7-1 describes the details of each table in details

T ABLE 7-1 INTRANET DATABASE TABLES

MESSAGE Holds the message title (MSG_TITLE), message number

(MSG_ID), message contents (MSG_CONTENTS), message date (MSG_DATE), message type (MSG_TYPE), flag (FLAG), and ID of the author who created the message

(AUTHOR_ID) The message number (MSG_ID) is automatically generated by the database

MSG_TRACK Contains the message tracking information It holds the user

ID (USER_ID) of the user who received the message, the message number (MSG_ID), and the time stamp when the message is read by the viewer user (READ_TS)

Continued