Secure PHP Development- P54 pps

Daily logbook manager applicationThe daily logbook manager application is called daily_logbook_mngr.php, which shows a daily breakdown of login/logout for a particular user.. It has the

Daily logbook manager application

The daily logbook manager application is called daily_logbook_mngr.php, which shows a daily breakdown of login/logout for a particular user This application is included on the CD-ROM in the ch07/appsdirectory

It has the following methods:

◆ run() : When the application is run, this method is called It does the

following:

■ Checks whether the user has administrative privilege

■ If the user has the administrative privilege and if she passes a user ID, she can view the access logs of that user as well run()sets

$this->userIDas the passed user ID Nonadministrative users are not allowed

to view others’ access logs They can view only their own logs

■ After setting the userID, it runs reportDriver(), which shows the daily activities of the intended user for the given date

◆ authorize() : This method authorizes access to this application It works

as follows:

■ It creates the DBIobject called $user_dbi, which points to the central user authentication database (USER_DB_URL)

■ A user object called $userObj is created using the $user_dbiand cur-rent user ID

■ The getType()is used to determine the current user type If the user is

an administrator (ADMIN_TYPE), the $isAdminvariable is set to TRUE

■ This method always returns TRUE, because everyone on the intranet can view this application

◆ reportDriver() : This method generates and displays the user access

report It works as follows:

■ It finds out all the timestamps (Office start timestamp, Lunch start timestamp, Lunch end timestamp, and so on) that are necessary to retrieve the activities of the day

■ It creates an object of the ActivityAnalyzerclass and uses the

getDailyLog()method of that object to get the daily activity log

■ It generates the report using the $LOG_DETAIL_TEMPLATEtemplate and shows it to the user

◆ convert(): This method converts timestamp values as taken from the

sec-onds as input into hours, minutes, and remaining secsec-onds and returns the resultant string

User tip application

The user tip application is called tips.phpand shows a tip of the day This appli-cation is included on the CD-ROM in the ch07/appsdirectory

It has the following methods:

◆ run() : This method is responsible for running the application It sets

$TIP_URLto the URL of the tip to be shown by randomly choosing a tip template and then redirects the application to show the tip template

◆ authorize() : This method authorizes everyone on the intranet to view

the document access list and, therefore, always returns TRUE

User preference application

Currently, the user can have two types of preferences: a specific theme ID or an automatic tip display on or off A preference application (discussed later) asks the user to choose a theme and enable/disable automatic tip on login options

A preference ID value of 1indicates that the preference is for a theme; a value of

2indicates that the user’s preference is for an automatic tip display

A theme is like a skin on the intranet interface that makes the intranet look

dif-ferent for difdif-ferent users The themes are HTML templates that are loaded by intranet applications, and the application’s own interface is embedded within the contents block area of the theme

The user preference application is called preference.php, and is included on the CD-ROM in the ch07/appsdirectory

This application enables users to choose a theme for their intranet home page and also allows them to toggle automatic tip display on login It has the following methods:

◆ run() : When the application is run, this method is called It decides which

functionality is requested by the user and calls the appropriate method to perform the desired operations It does the following:

■ Creates a theme object, $this->themeObj

■ The current user’s theme choice is stored in $this->themeby calling the getUserTheme()method of the theme object created

■ If the application is called with $pref = upd, the preferences are updated (At the first instance of preference change, if there is no pre-vious preference to update, run()adds the new preferences to the database Thereafter, it continues to update [and not insert] every time there is a request to change preference.)

■ displayMenu()is called to show the current preferences

◆ authorize() : This method authorizes everyone on the intranet to view

the document-access list and, therefore, always returns TRUE

◆ displayMenu() : This method displays the menu shown in the preference

page This is how it works:

■ A preference template ($PREFERNCE_TEMPLATE) is loaded in a template object called $template

■ The template contains a list of available themes that is loaded using the

getAllThemes()method of the Themeclass The current theme for the user viewing the page is preselected

■ It also contains two radio buttons for the auto tip option (Yes/No); one

of them is preselected based on the current user’s auto tip preference

■ The user’s preferences are retrieved using the getPreferences()

method of the intranetUserclass

■ The update button at the bottom of the template lets the user update her preferences, which she can change using the combo box and the radio buttons

■ The contents of the $templateobject are inserted into the

$themeTemplateobject’s content block and the results are printed on the user’s browser screen

Installing Intranet Applications from the CD-ROM

The installation process assumes the following:

◆ You are using a Linux system with MySQL and Apache server installed

◆ During the installation process, this directory is referred to as

%DocumentRoot%

◆ Your MySQL server is hosted on the intranet Web server and can be accessed via localhost However, if this is not the case, you can easily modify the database URLs in each application’s configuration files For example, the

home.conffile has MySQL database-access URLs such as the following:

$INTRANET_DB_URL=’mysql://root:foobar@localhost/INTRANET’

$USER_DB_URL = ‘mysql://root:foobar@localhost/auth’

If your database server is called db.domain.comand the username and password to access the INTRANETand authdatabases (which you will cre-ate during this installation process) are adminand db123, you would mod-ify the database access URLs throughout each configuration file as follows:

$INTRANET_DB_URL=’mysql://admin:db123@db.domain.com/INTRANET’

$USER_DB_URL = ‘mysql://admin:db123@db.domain.com/auth’

◆ You have installed the PHPLIBand PEARlibraries Normally, these are installed during PHP installation For your convenience, we have provided these in the lib/phplib.tar.gzand lib/pear.tar.gzdirectories on the CD-ROM In the sample installation steps, we assume that these are installed in the /evoknow/phpliband /evoknow/peardirectories

Because your installation locations for these libraries is likely to differ, make sure that you replace these paths in the configuration files

Here is how to get your intranet applications up and running:

1 Install the framework You need to extract the framework.tar.gzfile from the ch4directory on the CD-ROM This file should be placed in your

%DocumentRoot%directory and extracted

Once you extract it by using tar xvzf framework.tar.gz, the frame-work.tar.gzwill install the PHP Application Framework in the

%DocumentRoot%/frameworkdirectory

2 Install the central user-authentication applications If you have not yet

installed ch5.tar.gzfrom the CD-ROM (in the ch05directory), you should extract the ch5.tar.gzfile using tar xvzf ch5.tar.gz com-mand in your %DocumentRoot%directory

This installs central login/logout applications in the %DocumentRoot%/

loginand %DocumentRoot%/logoutapplications

Make sure that you create the authdatabase and an administrative user as discussed in Chapter 5 The quickest way to create this database, with an administrative user account called caroland password mysecret, is to run the following commands:

mysqladmin –u root –p create auth mysql –u root –p –D auth < auth.sql mysql –u root –p –D auth

mysql> insert into users (EMAIL, PASSWORD, ACTIVE, TYPE) values(‘carol@example.com’, ENCRYPT(‘mysecret’), 1, 9);

mysql> exit

The auth.sqlfile can be found in the ch5/sqldirectory on the CD-ROM

Make sure that you configure the login and logout applications using

%DocumentRoot%/login/login.confand %DocumentRoot%/logout/

logout.conffiles, respectively In most cases, you should need to change only paths and database access information

3 Install the central user-management system From the ch6directory of the CD-ROM, extract the user_mngr.tar.gzfile using tar xvzf user_mngr.tar.gzin your %DocumentRoot%directory

This will install the central user-management application in the

%DocumentRoot%/user_mngrdirectory Make sure that you configure the user manager applications by using the %DocumentRoot%/user_mngr/ apps/user_mngr.conffile In most cases, you should need to change only paths and database access information

4 Install the home applications If you have an index.phpfile in your

%DocumentRoot%, rename and back up this file Then, from the ch7 direc-tory of the CD-ROM, extract ch7.tar.gzin %DocumentRoot% This will create a home directory and photos directories in your document root, and

it will also install index.phpscript Configure %DocumentRoot%/home/ home.conffor path and database settings

Make sure that you create the INTRANETdatabase as discussed earlier in this chapter The quickest way to create this database is to run the follow-ing commands:

mysqladmin –u root –p create database INTRANET mysql –u root –p –D INTRANET < INTRANET.sql

The INTRANET.sqlfile can be found in the ch07/sqldirectory

5 Set the file/directory permissions Make sure that you’ve changed the file

and directory permissions so that your intranet Web server can access all the files The path pointed to by the $LD_CATEGORY_NAV_DIRvariable in

home.confmust be writeable by the Web server, because this is the navi-gation file that gets generated whenever a new document is published using the simple publishing tool discussed in Chapter 8 You should keep this directory outside your Web document tree if possible

After you’ve performed these steps, you’re ready to test your applications

Testing the Intranet Home Application

Log in to your intranet via http://yourserver/index.php using the username and password that you created in Chapter 6 If you used the database configuration steps described in the previous section, you should have at least a default user called carol(with password set to mysecret) that can log you into your intranet