Secure PHP Development- P51 pot

Intranet Home Application The home.php application is responsible for displaying an intranet home page to each user.. This method does the following: ■ If the user is not authenticated,

Variable Values

$TIP_SCRIPT Point the tip script (tip_script.js), which is needed to

show tips

$TIP_URL Point to the relative path, which is the parent of the tips

directory

$DEFAULT_THEME Set to the default theme ID By default, the theme is set to 1

$USER_DEFAULTS Point to an array that contains default preferences of all users

$MAX_AVAILABLE_TIP Set to the maximum number of tips that are available in the

tipsdirectory within the templatesdirectory

$ADMIN_MSG_COLOR Set the color shown to the viewers with administrative

privileges

$STANDARD_MSG_COLOR Set the color shown to the standard viewers

$OFFICE_START_TIME Set to the expected office start time, such as 10(for 10 a.m.)

$LUNCH_START_TIME Set the expected start time for lunch, such as 13(for 1 p.m.;

remember, we’re using a 24-hour format)

$LUNCH_END_TIME Set to the expected lunch end time, such as 14(for 2 p.m.)

$OFFICE_END_TIME Set to the expected office end time, such as: 19(for 7 p.m.)

$DEFAULT_REPORT_TYPE Set the default report type: MONTHLY, WEEKLY, or DAILY

$ACCESS_REPORT_ Set the color for the even rows of the report The color value EVEN_ROW_COLOR is in HTML color format (RGB)

$ACCESS_REPORT_ Set the color for the odd rows of the report The color value ODD_ROW_COLOR is in HTML color format (RGB)

$ACCESS_RPT_OFFICE_ Set the text color for the regular office hours of the access HR_TEXT_COLOR_REGULAR report The color value is in HTML color format (RGB)

$ACCESS_RPT_OFFICE_HR_ Set the text color for the extra office hours of the access TEXT_COLOR_IRREGULAR report The color value is in HTML color format (RGB)

$ADMIN_TYPE Set the user type value that will indicate an administrative

user level The default value of 9is okay

$EXPECTED_OFFICE_HRS Set to the daily office hours that are expected to be maintained

by every employee The default is set to 8hours per day

Continued

T ABLE7-2 HOME.CONF SETTINGS (Continued)

$GRACE Set to the grace period (in seconds) The default value is 600

seconds (10 minutes) This means that if an employee fails to meet the full office hours requirements by 10 minutes or less, the grace period is applied to make up her full office hours

$WEEKEND Set to the day(s) of the week that is/are considered as

weekend The default values (‘Sat’, ‘Sun’) should be standard for most places on this planet Keep the default

Setting Up the Application Templates

The HTML interface templates needed for the applications are included on the CD-ROM These templates contain various template tags to display necessary infor-mation dynamically The templates are named in the home.conf file Table 7-3 explains the purpose of each template

T ABLE 7-3 HTML TEMPLATES

home_status.html Shows status messages when user performs an

operation such as updating preference settings access_report.html Used to display an access report

msg_mngr.html Shows message-management options to users msg_preview.html Shows the preview of a message to users

log_detail.html Shows the log details for a day

admin_access_report.html Shows the access report to administrators

These templates also use images that are stored in an image directory called imageswithin the template directory pointed by the $TEMPLATE_DIRvariable in the home.conffile

Intranet Home Application

The home.php application is responsible for displaying an intranet home page to each user The application is included on the CD-ROM in the ch07/appsdirectory

home.phpimplements the following functionality:

◆ It displays the intranet home page to each user after the user is logged in

◆ It uses the home page to show any message(s) that the user needs to view

◆ When the user clicks the OK button of a message (to indicate that he has read the message), the application updates the message-tracking table so that the same message is not displayed again

This application has the following methods:

◆ run() : This method is responsible for running the application This

method does the following:

■ If the user is not authenticated, it displays an alert message and returns the user to previous page This effectively terminates the application

■ If the user is authenticated, it creates a theme object,

$this->themeObj

■ The current user’s theme choice is stored in $this->themeby calling the getUserTheme()method of the theme object created

■ When the user comes to the home application after clicking the OK button to indicate that she has read a message, this method calls the updateMsgTrack()method

■ Then the displayHome()method is called to display the intranet home page

◆ displayHome() : This method displays the home page of the intranet

sys-tem and also shows specific messages to specific users Here is how it works:

■ It applies the appropriate theme to the page

■ It checks whether tips are to be shown to the user and sets tip informa-tion accordingly

■ It sets the photo of the user who has requested this page

■ It sets the current date and time on the home page.

■ It sets any new or unread messages for the user in appropriate places in the appropriate order

■ It parses or renders the page information and shows the page accord-ingly to the user

Other methods for this application include those described in the following table:

authorize() Authorizes everyone on the intranet to view the page and,

therefore, always returns TRUE updateMsgTrack() Takes the message ID that has been read by the user and

updates the database accordingly

getName() Finds and returns the formatted first name of the user retrieved

from the viewer’s username (e-mail address)

popAutoTip() Pops up a tip of the day It is called from the displayHome()

method if the user has the auto-tip option ONin her preference unhtmlentities() The exact reverse of the htmlentities()method in the

PHP API

Now we will develop a set of mini applications that can be run from the home page of each user They are as follows:

◆ MOTDO manager application: This application is used to send intranet

messages from one user to another It is ideally used by administrators to

notify users of company-wide events, hence it is named the MOTD (Message of the Day) application.

◆ Access reporter application: This application is used to provide

login/logout reports for intranet users Each user can view her access log information in a nicely formatted manner to see how she is keeping her office hours Users cannot view other user’s access report

◆ Admin access reporter application: This application allows intranet

administrators to view anyone’s access report in a daily, weekly, or monthly view

◆ Daily logbook application: This application allows users to view the

login/logout activities for a given day

◆ User preference application: This application allows users to set their

themes and automatic tip-preference settings

◆ User tip application: This application shows an automatic tip from the tip

directory when a user sets her preference to receive an automatic tip on each login

The details of these applications are discussed in the following sections

MOTD manager application

The MOTD manager application, ln_msg_mngr.php, is responsible for managing daily messages It is included on the CD-ROM in the ch07/appsdirectory

The application implements the following functionality:

◆ It enables all users to create, modify, and delete messages.

Administrative users use a different message template than regular users

so that admin messages can be easily identified

◆ It enables all users to select viewers for each message while adding or modifying messages.

This application has the following methods:

◆ run() : When the application is run, this method is called It does the

following:

■ Calls the authorize()method to see whether the user is allowed to access this application If the user is not allowed, it displays an alert message and returns her to the home page

■ Creates a theme object called $this->themeObjand retrieves the theme selection for the current user by using the getUserTheme()method The chosen theme is set to $this->themevariable of the application

■ Uses two query parameters, cmdand step, to determine which message operation (add, modify, delete) is requested and what step of the operation needs to be processed When cmdis set to add, stepcan be null, which represents the start of the add message operation, and, therefore, displayMsgAddModMenu()is called to show the add message interface After the user fills out the new message information, the interface submits a stepparameter with a value of 2, indicating that the user has submitted a new message Then confirmMessage()is called to display a confirmation page showing the message for the user

to confirm When the user confirms the message, the step parameter is