Secure PHP Development- P51 pot

Variable Values $TIP_SCRIPT Point the tip script (tip_script.js), which is needed to show tips. $TIP_URL Point to the relative path, which is the parent of the tips directory. $DEFAULT_THEME Set to the default theme ID. By default, the theme is set to 1. $USER_DEFAULTS Point to an array that contains default preferences of all users. $MAX_AVAILABLE_TIP Set to the maximum number of tips that are available in the tips directory within the templates directory. $ADMIN_MSG_COLOR Set the color shown to the viewers with administrative privileges. $STANDARD_MSG_COLOR Set the color shown to the standard viewers. $OFFICE_START_TIME Set to the expected office start time, such as 10 (for 10 a.m.). $LUNCH_START_TIME Set the expected start time for lunch, such as 13 (for 1 p.m.; remember, we’re using a 24-hour format). $LUNCH_END_TIME Set to the expected lunch end time, such as 14 (for 2 p.m.). $OFFICE_END_TIME Set to the expected office end time, such as: 19 (for 7 p.m.). $DEFAULT_REPORT_TYPE Set the default report type: MONTHLY, WEEKLY, or DAILY. $ACCESS_REPORT_ Set the color for the even rows of the report. The color value EVEN_ROW_COLOR is in HTML color format (RGB). $ACCESS_REPORT_ Set the color for the odd rows of the report. The color value ODD_ROW_COLOR is in HTML color format (RGB). $ACCESS_RPT_OFFICE_ Set the text color for the regular office hours of the access HR_TEXT_COLOR_REGULAR report. The color value is in HTML color format (RGB). $ACCESS_RPT_OFFICE_HR_ Set the text color for the extra office hours of the access TEXT_COLOR_IRREGULAR report. The color value is in HTML color format (RGB). $ADMIN_TYPE Set the user type value that will indicate an administrative user level. The default value of 9 is okay. $EXPECTED_OFFICE_HRS Set to the daily office hours that are expected to be maintained by every employee. The default is set to 8 hours per day. Continued Chapter 7: Intranet System 221 10 549669 ch07.qxd 4/4/03 9:25 AM Page 221 TABLE 7-2 HOME.CONF SETTINGS (Continued) Variable Values $GRACE Set to the grace period (in seconds). The default value is 600 seconds (10 minutes). This means that if an employee fails to meet the full office hours requirements by 10 minutes or less, the grace period is applied to make up her full office hours. $WEEKEND Set to the day(s) of the week that is/are considered as weekend. The default values ( ‘Sat’, ‘Sun’) should be standard for most places on this planet. Keep the default. Setting Up the Application Templates The HTML interface templates needed for the applications are included on the CD-ROM. These templates contain various template tags to display necessary infor- mation dynamically. The templates are named in the home.conf file. Table 7-3 explains the purpose of each template. TABLE 7-3 HTML TEMPLATES File Name Purpose home.html Home page template of intranet. home_status.html Shows status messages when user performs an operation such as updating preference settings. access_report.html Used to display an access report. add_msg.html Used to add an intranet message. msg_mngr.html Shows message-management options to users. msg_preview.html Shows the preview of a message to users. preference.html Shows the theme preference page. log_detail.html Shows the log details for a day. admin_access_report.html Shows the access report to administrators. 222 Part II: Developing Intranet Solutions 10 549669 ch07.qxd 4/4/03 9:25 AM Page 222 These templates also use images that are stored in an image directory called images within the template directory pointed by the $TEMPLATE_DIR variable in the home.conf file. Intranet Home Application The home.php application is responsible for displaying an intranet home page to each user. The application is included on the CD-ROM in the ch07/apps directory. home.php implements the following functionality: ◆ It displays the intranet home page to each user after the user is logged in. ◆ It uses the home page to show any message(s) that the user needs to view. ◆ When the user clicks the OK button of a message (to indicate that he has read the message), the application updates the message-tracking table so that the same message is not displayed again. This application has the following methods: ◆ run(): This method is responsible for running the application. This method does the following: ■ If the user is not authenticated, it displays an alert message and returns the user to previous page. This effectively terminates the application. ■ If the user is authenticated, it creates a theme object, $this- >themeObj . ■ The current user’s theme choice is stored in $this->theme by calling the getUserTheme() method of the theme object created. ■ When the user comes to the home application after clicking the OK button to indicate that she has read a message, this method calls the updateMsgTrack() method. ■ Then the displayHome() method is called to display the intranet home page. ◆ displayHome(): This method displays the home page of the intranet sys- tem and also shows specific messages to specific users. Here is how it works: ■ It applies the appropriate theme to the page. ■ It checks whether tips are to be shown to the user and sets tip informa- tion accordingly. ■ It sets the photo of the user who has requested this page. Chapter 7: Intranet System 223 10 549669 ch07.qxd 4/4/03 9:25 AM Page 223 ■ It sets the current date and time on the home page. ■ It sets any new or unread messages for the user in appropriate places in the appropriate order. ■ It parses or renders the page information and shows the page accord- ingly to the user. Other methods for this application include those described in the following table: Method Description authorize() Authorizes everyone on the intranet to view the page and, therefore, always returns TRUE. updateMsgTrack() Takes the message ID that has been read by the user and updates the database accordingly. getName() Finds and returns the formatted first name of the user retrieved from the viewer’s username (e-mail address). popAutoTip() Pops up a tip of the day. It is called from the displayHome() method if the user has the auto-tip option ON in her preference. unhtmlentities() The exact reverse of the htmlentities() method in the PHP API. Now we will develop a set of mini applications that can be run from the home page of each user. They are as follows: ◆ MOTDO manager application: This application is used to send intranet messages from one user to another. It is ideally used by administrators to notify users of company-wide events, hence it is named the MOTD (Message of the Day) application. ◆ Access reporter application: This application is used to provide login/logout reports for intranet users. Each user can view her access log information in a nicely formatted manner to see how she is keeping her office hours. Users cannot view other user’s access report. ◆ Admin access reporter application: This application allows intranet administrators to view anyone’s access report in a daily, weekly, or monthly view. ◆ Daily logbook application: This application allows users to view the login/logout activities for a given day. 224 Part II: Developing Intranet Solutions 10 549669 ch07.qxd 4/4/03 9:25 AM Page 224 ◆ User preference application: This application allows users to set their themes and automatic tip-preference settings. ◆ User tip application: This application shows an automatic tip from the tip directory when a user sets her preference to receive an automatic tip on each login. The details of these applications are discussed in the following sections. MOTD manager application The MOTD manager application, ln_msg_mngr.php, is responsible for managing daily messages. It is included on the CD-ROM in the ch07/apps directory. The application implements the following functionality: ◆ It enables all users to create, modify, and delete messages. Administrative users use a different message template than regular users so that admin messages can be easily identified. ◆ It enables all users to select viewers for each message while adding or modifying messages. This application has the following methods: ◆ run(): When the application is run, this method is called. It does the following: ■ Calls the authorize() method to see whether the user is allowed to access this application. If the user is not allowed, it displays an alert message and returns her to the home page. ■ Creates a theme object called $this->themeObj and retrieves the theme selection for the current user by using the getUserTheme() method. The chosen theme is set to $this->theme variable of the application. ■ Uses two query parameters, cmd and step, to determine which message operation (add, modify, delete) is requested and what step of the operation needs to be processed. When cmd is set to add, step can be null, which represents the start of the add message operation, and, therefore, displayMsgAddModMenu() is called to show the add message interface. After the user fills out the new message information, the interface submits a step parameter with a value of 2, indicating that the user has submitted a new message. Then confirmMessage() is called to display a confirmation page showing the message for the user to confirm. When the user confirms the message, the step parameter is Chapter 7: Intranet System 225 10 549669 ch07.qxd 4/4/03 9:25 AM Page 225 . Application The home .php application is responsible for displaying an intranet home page to each user. The application is included on the CD-ROM in the ch07/apps directory. home .php implements the. option ON in her preference. unhtmlentities() The exact reverse of the htmlentities() method in the PHP API. Now we will develop a set of mini applications that can be run from the home page of each. discussed in the following sections. MOTD manager application The MOTD manager application, ln_msg_mngr .php, is responsible for managing daily messages. It is included on the CD-ROM in the ch07/apps directory. The