Secure PHP Development- P92 docx

Now let’s try a more complex search usmatch-ing the AND operator, as shown in Figure 12-5.. The search for “built-in and nature” found the results shown in Figure 12-6.. Figure 12-6: Sea

As you can see, you can easily click on the appropriate links to view the match-ing sections Now let’s try a more complex search usmatch-ing the AND operator, as shown

in Figure 12-5

Figure 12-5: A search with the AND operator.

The search for “built-in and nature” found the results shown in Figure 12-6

Figure 12-6: Search results for “built-in and nature.”

426 Part II: Developing Intranet Solutions

Notice that previous searches are shown as recent search links This allows you

to view a previous search result without reentering the keywords Also, if the appli-cation is used by other users, this will show you what are the most recent keywords that have been searched by other users

The help provided as the Help on Help System serves as a guide to how you can set up help for your own application.

If you update your help files and want to regenerate the keyword index, you can run the makeindex.php script This will update all applications For example, Figure 12-7 shows a sample run of makeindex.php

Figure 12-7: Creating a keyword index for all applications.

To limit creating an index to a single application, use app=application_namein the query string For example, http://yourserver/help/apps/makeindex.

php?app=self will only create an index for the help application itself To create keyword indices for multiple but not all applications, use the URL calls such as:

http://yourserver/help/apps/makeindex.php?app[]=app_name1&app[]=app_name2

Security Considerations

Like all other applications you’ve developed in this book, the online help system has some security considerations that you need to be aware of They are discussed here

Chapter 12: Online Help System 427

Restricting access to makeindex.php script

The makeindex.php writes keyword index cache files in each application’s help directory Therefore, you must make this directory writable by the Web server Any time you have an application that is writing new files to your Web site, you need to ensure that this isn’t going be abused in any way One of the best ways to protect against abuse is to make sure the application has limited access

You can limit the use of the makeindex.php to your own network by utilizing the following help.confparameters: ACL_ALLOW_FROMand ACL_DENY_FROM For example

define(‘ACL_ALLOW_FROM’, ‘192.168.0.10’);

define(‘ACL_DENY_FROM’, ‘0.0.0.0’);

Here, the allow list specifies that access to makeindex.php is allowed from 192.168.0.10and denied from every host of every network The 0octet in the net-work address in ACL_DENY_FROMcan be thought of as “don’t care.” Because I spec-ified 0.0.0.0, I stated that I deny all hosts, and then I opened the access for 192.168.0.11

Similarly, if you want to allow everyone but deny one IP address, you can make configuration such as:

define(‘ACL_ALLOW_FROM’, ‘0.0.0.0’);

define(‘ACL_DENY_FROM’, ‘192.168.0.11,192.168.0.12’);

Here access is allowed to everyone but 192.168.0.11and 192.168.0.12 You can also specify network IP addresses when defining these rules For example: define(‘ACL_ALLOW_FROM’, ‘192.168.0’);

define(‘ACL_DENY_FROM’, ‘0.0.0.0’);

Here access is granted for all hosts in the 198.168.0.x network That means 192.168.0.1to 192.168.0.254can access the makeindex.phpscript

Summary

In this chapter, you learned to develop an online help system that allows you to provide a central help facility for all your Web or intranet applications It gives you

a structured approach to designing online help for your applications, which is great for developers who are often reluctant to write help for the users

428 Part II: Developing Intranet Solutions

Developing E-mail Solutions

CHAPTER 13

Tell-a-Friend System

CHAPTER 14

E-mail Survey System

CHAPTER 15

E-campaign System

Part III