Securing dbasis with the standard, Syntax session-based authentication turns out to be relatively simple. The version of dbasis in cvs now has this for all future sites going forward. To secure exisiting instances drop in the following code after line 115. This requires a login from a user in the admin group.
line 115: $session->initialize();
# Authentication
# --------------
require_once($PXDB_PATH . '/classes/auth/pxdb_auth.class.php');
$auth = &new pxdb_auth('dbasis');
$auth->set_username_field('idnum');
//$auth->debug = true;
// restrict to admin group
if($_GET['logout']) { $auth->logout(); }
$auth->restrict( 'admin' );
if(!($user = &$auth->authenticate())) {
//include(SITE_ROOT . '/display/header.disp.php');
$auth->showlogin();
//include(SITE_ROOT . '/display/footer.disp.php');
exit;
}
I had to re-figure this out today, so I thought I'd document it to save hair-pulling later.
If you are mucking about with Syntax's API innards (the pxdb_* classes) and make a structural change to the database, you need to create an upgrade script to handle it.
Background: Every time the Syntax API gets used, it calls PxDB/config/initialize.php. This checks to see if its sister-file run-once.php has been modified more recently than the database has been initialized. If so, it runs it.
initialize.php has a place to define the current version of the Syntax API. This is used by run-once to determine if an upgrade script needs to be run. If the version number is lower in the database than the file, it runs the script. If the version number is higher in the database than the file, it fires off a warning. If two version numbers are the same, it does not include an upgrade script.
The upgrade script goes in PxDB/config/install/ and should be named according to the ADODB name for the database you're using followed by a hyphen and the word "upgrade", e.g. mysql-upgrade.php. The script should ideally check the version number and retain previous upgrades, so theoretically someone could go from a version 0.0.1 to the absolute latest and catch all relevant upgrades.
You should also test for the existence of various columns and tables that you wish to affect so you don't get someone with a mismatched version number in too much trouble.
Once you've done all your testing, alter any tables and convert any data. Finally the script should set the version number in the DB pref key to the version number you've declared in initialize.php IF AND ONLY IF every SQL statement has executed successfully.
Note: This is true as of version 0.0.5. Oooh! Did I slip some news in? Maybe!
Problem:
On a Syntax site, You have a uri like
http://www.mysite.com/content/news/detail/5678/ and you need to extract
the number to use as your record id:
Continue reading "From Oscar: Extracting parameters from Request URI"
