Secure PHP Development- P43 pdf

$thisApp = new userManagerApp( array( ‘app_name’ => $APPLICATION_NAME, ‘app_version’ => ‘1.0.0’, ‘app_type’ => ‘WEB’, ‘app_db_url’ => $APP_DB_URL, ‘app_auto_authorize’ => FALSE, ‘app_auto_connect’ => TRUE, ‘app_auto_chk_session’ => FALSE, ‘app_debugger’ => $ON ) ); //$thisApp->buffer_debugging(); $thisApp->run(); //$thisApp->dump_debuginfo(); ?> Configuring user administration applications The user manager application and all the other applications in the user manage- ment system require configuration information that is stored in user_mngr.conf. Table 6-2 shows the configuration settings. TABLE 6-2 USER MANAGER CONFIGURATION Variable Purpose $PEAR_DIR Set to the directory containing the PEAR package; specifically the DB module needed for class.DBI.php in our application framework. $PHPLIB_DIR Set to the PHPLIB directory, which contains the PHPLIB packages; specifically the template. inc package needed for template manipulation. $APP_FRAMEWORK_DIR Set to our application framework directory. Continued Chapter 6: Central User Management System 181 09 549669 ch06.qxd 4/4/03 9:24 AM Page 181 TABLE 6-2 USER MANAGER CONFIGURATION (Continued) Variable Purpose $PATH Set to the combined directory path consisting of the $PEAR_DIR, the $PHPLIB_DIR, and the $APP_FRAMEWORK_DIR. This path is used with the ini_set() method to redefine the php.ini entry for include_path to include $PATH ahead of the default path. This allows PHP to find our application framework, PHPLIB, and PEAR-related files. $AUTHENTICATION_URL Set to the central login application URL. $LOGOUT_URL Set to the central logout application URL. $APPLICATION_NAME The internal name of the application. $DEFAULT_LANGUAGE Set to the default (two character) language code. $DEFAULT_DOMAIN Set to the default domain of the user. This domain is appended when the user does not specify the fully qualified username ( user@host) during interaction with the user management applications. $ROOT_PATH Set to the parent directory within the Web server’s document root where the user- manager-specific directory exists as a subdirectory. $REL_APP_PATH The relative application path as seen from Web browser. $TEMPLATE_DIR Set to the template directory containing the ihtml template files needed for the user management applications. $CLASS_DIR Set to the class directory where user- management-related class files are stored. $USER_CLASS Fully qualified pathname for the User class. $MIN_USERNAME_SIZE Minimum user name (EMAIL) size. $MIN_PASSWORD_SIZE Minimum password size. 182 Part II: Developing Intranet Solutions 09 549669 ch06.qxd 4/4/03 9:24 AM Page 182 Variable Purpose $DUMMY_PASSWD Dummy password used during account modification step. $ROOT_USER Fully qualified username of the root user $SECRET A secret random number used in checksum generation, which is used when forgotten password URL links are sent via e-mail. $CHAR_SET Default character set to be used in e-mail content type header. $USERMNGR_MNGR Name of the user manager application. $USERMNGR_FORGOTTEN_APP Name of the forgotten password application. $USERMNGR_CHANGE_PWD_APP Name of the change password application. $REL_TEMPLATE_DIR Relative path to the template directory as seen from the Web. $APP_DB_URL The fully qualified database URL needed to access the user database. $USER_TBL Name of the user table. $STATUS_TEMPLATE Name of the status information display template. $USERMNGR_MENU_TEMPLATE Name of the user management menu template. $USERMNGR_USER_TEMPLATE Name of the user add/modify form template. $USERMNGR_PWD_REQUEST_TEMPLATE Name of the password change template. $USERMNGR_PWD_EMAIL_TEMPLATE Name of the e-mail template, which is used to send the e-mail message for forgotten passwords. $USERMNGR_PWD_RESET_TEMPLATE Name of the forgotten password reset template. $USERMNGR_PWD_CHANGE_TEMPLATE Name of the password change template. $ADMINISTRATIVE_USER Numeric type value for administrative user. $STANDARD_USER Numeric type value for standard user. $USER_TYPE Associative array defining the relationship between the numeric user type and user type labels. Chapter 6: Central User Management System 183 09 549669 ch06.qxd 4/4/03 9:24 AM Page 183 Listing 6-3 shows the configuration file (user_mngr.conf). Listing 6-3: user_mngr.conf <?php // Turn on all error reporting error_reporting(E_ALL); // If you have installed framework directory in // a different directory than // %DocumentRoot%/framework, change the setting below. $APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’; $PEAR =$_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’; $PHPLIB =$_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; // Insert the path in the PHP include_path so that PHP // looks for PEAR, PHPLIB and our application framework // classes in these directories ini_set( ‘include_path’, ‘:’ . $PEAR . ‘:’ . $PHPLIB . ‘:’ . $APP_FRAMEWORK_DIR . ‘:’ . ini_get(‘include_path’)); $AUTHENTICATION_URL = “/login/login.php”; $LOGOUT_URL = “/logout/logout.php”; $APP_MENU = ‘/home/home.php’; $APPLICATION_NAME = ‘USER_MNGR’; $XMAILER_ID = ‘Example User Manager Version 1.0’; $DEFAULT_LANGUAGE = ‘US’; $DEFAULT_DOMAIN = ‘example.com’; $ROOT_PATH = $_SERVER[‘DOCUMENT_ROOT’]; $REL_ROOT_PATH = ‘/user_mngr’; $REL_APP_PATH = $REL_ROOT_PATH . ‘/apps’; $TEMPLATE_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/templates’; $CLASS_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/class’; $REL_TEMPLATE_DIR = $REL_APP_PATH . ‘/templates/’; 184 Part II: Developing Intranet Solutions 09 549669 ch06.qxd 4/4/03 9:24 AM Page 184 require_once “user_mngr.errors”; require_once “user_mngr.messages”; require_once ‘DB.php’; require_once $APP_FRAMEWORK_DIR . ‘/’ . ‘constants.php’; require_once $APP_FRAMEWORK_DIR . ‘/’ . $APPLICATION_CLASS; require_once $APP_FRAMEWORK_DIR . ‘/’ . $ERROR_HANDLER_CLASS; require_once $APP_FRAMEWORK_DIR . ‘/’ . $AUTHENTICATION_CLASS; require_once $APP_FRAMEWORK_DIR . ‘/’ . $DBI_CLASS; require_once $APP_FRAMEWORK_DIR . ‘/’ . $USER_CLASS; require_once $TEMPLATE_CLASS; $MIN_USERNAME_SIZE= 3; $MIN_PASSWORD_SIZE= 3; $DUMMY_PASSWD = ‘1234567890’; $ROOT_USER = ‘kabir@evoknow.com’; $SECRET = 916489; $CHAR_SET = ‘charset=iso-8859-1’; // Application names $USERMNGR_MNGR = ‘user_mngr.php’; $USERMNGR_FORGOTTEN_APP = ‘user_mngr_forgotten_pwd.php’; $USERMNGR_CHANGE_PWD_APP = ‘user_mngr_passwd.php’; /* START TABLE NAMES */ $APP_DB_URL = ‘mysql://root:foobar@localhost/auth’; $AUTH_DB_TBL = ‘users’; /* END TABLE NAMES */ $STATUS_TEMPLATE = ‘usermngr_status.html’; $USERMNGR_MENU_TEMPLATE = ‘usermngr_menu.html’; $USERMNGR_USER_TEMPLATE = ‘usermngr_user_form.html’; $USERMNGR_PWD_REQUEST_TEMPLATE= ‘usermngr_forgotten_pwd.html’; $USERMNGR_PWD_EMAIL_TEMPLATE = ‘usermngr_forgotten_pwd_email.html’; $USERMNGR_PWD_RESET_TEMPLATE = ‘usermngr_pwd_reset.html’; $USERMNGR_PWD_CHANGE_TEMPLATE = ‘usermngr_pwd_change.html’; $ADMINISTRATIVE_USER = 9; $STANDARD_USER = 1; $USER_TYPE = array(‘9’ => ‘Administrator’, ‘1’ => ‘Standard User’); ?> Make sure you change this file to adjust the file and directory path information as needed. Chapter 6: Central User Management System 185 09 549669 ch06.qxd 4/4/03 9:24 AM Page 185 . =$_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’; $PHPLIB =$_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’; // Insert the path in the PHP include_path so that PHP // looks for PEAR, PHPLIB and our application framework //. specifically the DB module needed for class.DBI .php in our application framework. $PHPLIB_DIR Set to the PHPLIB directory, which contains the PHPLIB packages; specifically the template. inc package. . $PEAR . ‘:’ . $PHPLIB . ‘:’ . $APP_FRAMEWORK_DIR . ‘:’ . ini_get(‘include_path’)); $AUTHENTICATION_URL = “/login/login .php ; $LOGOUT_URL = “/logout/logout .php ; $APP_MENU = ‘/home/home .php ; $APPLICATION_NAME