Secure PHP Development- P96 docx

Creating Application Configuration Files Like all other applications you’ve developed in this book, Tell-a-Friend applications also use a standard set of configuration, message, and erro

◆ The method directly returns null when it finds out, using the numRows()

method, that $resultobject has no rows

◆ Otherwise $retArrarray is prepared with all the banned IPs

◆ At the end, the $retArris returned from the method

addAccessIPs()

This method inserts IP addresses to the authorized table for the given object It takes

an array of IP addresses as a parameter and adds them one by one into the autho-rized table

deleteAccessIP()

This method deletes all the IP addresses from the authorized table for a given object

ID It takes the object ID as parameter and returns TRUEor FALSEdepending on the status of the deletion operation

addDeniedIPs()

This method inserts IP addresses to the denied table for the given object It takes an array of IP addresses as a parameter and adds them one by one into the denied table

deleteDeniedIP()

This method deletes all the IP addresses from the denied table for a given object ID

It takes the object ID as parameter and returns TRUEor FALSEdepending on the sta-tus of the deletion operation

Creating Application Configuration Files

Like all other applications you’ve developed in this book, Tell-a-Friend applications also use a standard set of configuration, message, and error files These files are dis-cussed in the following sections

Creating the main configuration file

The primary configuration file for the entire system is called taf.conf Table 13-1 discusses each configuration variables

T ABLE 13-1 THE taf.confVARIABLES NEED TO BE CHANGED Configuration Variable Purpose

$PEAR_DIR Set to the directory containing the PEAR package;

specifically the DB module needed for class.DBI.php

in our application framework

$PHPLIB_DIR Set to the PHPLIB directory, which contains the

PHPLIB packages; specifically the template.inc package needed for template manipulation

$APP_FRAMEWORK_DIR Set to our application framework directory

$PATH Set to the combined directory path consisting of the

$PEAR_DIR, the $PHPLIB_DIR, and the

$APP_FRAMEWORK_DIR This path is used with the ini_set()method to redefine the php.inientry for include_pathto include $PATHahead of the default path This allows PHP to find our application framework, PHPLIB, and PEAR-related files

$AUTHENTICATION_URL Set to the central login application URL

$LOGOUT_URL Set to the central logout application URL

$HOME_URL Set to the topmost URL of the site If the URL

redirection application does not find a valid URL in the e-campaign database to redirect to for a valid request,

it uses this URL as a default

$APPLICATION_NAME Internal name of the application

$DEFAULT_LANGUAGE Set to the default (two characters) language code

$ROOT_PATH Set to the root path of the application

$REL_ROOT_PATH Relative path to the root directory

$REL_APP_PATH Relative application path as seen from the web

browser

$TEMPLATE_DIR The fully qualified path to the template directory

$CLASS_DIR The fully qualified path to the class directory

$REL_TEMPLATE_DIR The Web-relative path to the template directory used

Continued

T ABLE 13-1 THE taf.confVARIABLES NEED TO BE CHANGED (Continued)

Configuration Variable Purpose

ACCESS_CONTROL_CLASS Name of the AccessControlclass file

MSG_CLASS Name of the Messageclass file

FRM_CLASS Name of the Formclass file

$TAF_DB_URL The fully qualified URL for the database used to store

the Tell-A-Friend information

TAF_FRM_TBL Name of the form table in the database

TAF_FRM_OWNER_IP_TBL Name of the table that stores authorized IPs for forms

in the database

TAF_FRM_RESTRICT_IP_TBL Name of the table that stores banned IPs for forms in

the database

TAF_MSG_OWNER_IP_TBL Name of the table that stores authorized IPs for

messages in the database

TAF_MSG_TBL Name of the message table in the database

TAF_FRM_SUBMTN_TBL Name of the form submission table in the database TAF_SUBSCRIPTION_TBL Name of the friend subscription table in the database

$STATUS_TEMPLATE Name of the status template file used to display status

messages

TAF_MENU_TEMPLATE Name of the Tell-A-Friend index template file TAF_CREATOR_REPORT_TEMPLATE Name of the report template for the form creator TAF_FRM_SETUP_TEMPLATE Name of the Tell-A-Friend form setup template file TAF_MSG_SETUP_TEMPLATE Name of the Tell-A-Friend message setup template file TAF_FRIEND_MSG_TEMPLATE Name of the Tell-A-Friend “mail to the friend”

template file

TAF_ORIGIN_MSG_TEMPLATE Name of the Tell-A-Friend “mail to the originator”

template file

TAF_ORIGIN_REPORT_TEMPLATE Name of the report template for the originator MIN_YEAR The earliest year to be shown in different year lists MAX_YEAR The latest year to be shown in different year lists TOP The number of originators to be shown in the top user

list in the form creator report

The directory structure used in the taf.conffile supplied in the ch13directory

on the CD-ROM might need to be tailored to your own system’s requirements Here

is what the current directory structure looks like:

htdocs ($ROOT_PATH == %DocumentRoot%)

| + -taf (Tell-a-Friend Applications)

| + -apps (apps and configuration files)

| + -class (class files)

| + -templates (HTML templates) )

By changing the following configuration parameters in taf.conf, you can mod-ify the directory structure to fit your site requirements:

$PEAR_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/pear’ ;

$PHPLIB_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/phplib’;

$APP_FRAMEWORK_DIR = $_SERVER[‘DOCUMENT_ROOT’] ‘/framework’;

$ROOT_PATH = $_SERVER[‘DOCUMENT_ROOT’];

$REL_ROOT_PATH = ‘/taf’;

$REL_APP_PATH = $REL_ROOT_PATH ‘/apps’;

$TEMPLATE_DIR = $ROOT_PATH $REL_APP_PATH ‘/templates’;

$CLASS_DIR = $ROOT_PATH $REL_APP_PATH ‘/class’;

$REL_TEMPLATE_DIR = $REL_APP_PATH ‘/templates/’;

Creating a Messages file

The messages displayed by the Tell-a-Friend applications are stored in the

ch13/apps/taf.messagesfile in the CDROM You can change the messages using

a text editor

Creating an Errors file

The error messages displayed by the Tell-a-Friend applications are stored in the

ch13/apps/taf.errors file in the CD-ROM You can modify the error messages using a text editor

Creating Application Templates

The HTML interface templates needed for the applications are included on the CD-ROM These templates contain various template tags to display necessary infor-mation dynamically The templates are named in the taf.conffile These templates are discussed in Table 13-2

T ABLE 13-2 HTML TEMPLATES Configuration Variable Template File Purpose

$STATUS_TEMPLATE taf_status.html This template is used to

show the status message TAF_MENU_TEMPLATE taf_menu.html This template is used to

show the index page of the application

TAF_CREATOR_REPORT_ taf_report_creator This template is used for

the form creator TAF_FRM_SETUP_TEMPLATE taf_setup.html This template is used to

show the form setup menu

TAF_MSG_SETUP_TEMPLATE taf_add_modify_ This template is used for

msg.html the message add/modify

menu

TAF_FRIEND_MSG_TEMPLATE taf_frnd_msg.html This template is used

while sending mail to the friend

TAF_ORIGIN_MSG_TEMPLATE taf_orig_msg.html This template is used

while sending mail to the originator

TAF_ORIGIN_REPORT_ taf_report_origin This template is used for

the originator