Secure PHP Development- P57 docx

Figure 8-2: Intranet document publisher system diagram. The Category class The Category class is used to manipulate each category. It allows an application to cre- ate, modify, and delete a category. The ch08/apps/class/class.Category.php file in the CDROM an implementation of this class. This class uses the following methods: ◆ Category(): This is the constructor method. It performs the following functions: ■ Sets the object variable cat_tbl to $LD_CATEGORY_TBL, which is loaded with the category table name (LD_CATEGORY) from the ld.conf file. ■ Sets the object variable doc_tbl to $LD_DOC_TBL, which is loaded with the document table name (LD_DOCUMENT) from the ld.conf file. ■ Sets the object variable cat_pub_tbl to $LD_CAT_PUB_TBL, which is loaded with the category publisher table from the ld.conf file. ■ Sets the object variable cat_view_tbl to $LD_CAT_VIEW_TBL, which is loaded with the category viewer table name from the ld.conf file. ■ Sets the object variable dbi to point to the class.DBI.php-provided object that is passed to the constructor by an application. The dbi member variable holds the DBI object that is used to communicate with the back-end database. ■ Sets the object variable CAT_ID to the given category ID (if any). ■ Sets the object variable std_fields, which is an array that contains the LD_CATEGORY table attributes and their data type. Central Login/Logout Messages Categories Documents Response User Home Interface PHP Application Framework Message Object Simple Intranet Document Publisher Applications Category Object Doc Object Response Object class.Message.php class.Category.php class.Doc.php class.Response.php Chapter 8: Intranet Simple Document Publisher 251 11 549669 ch08.qxd 4/4/03 9:25 AM Page 251 ◆ loadCatInfo(): This method loads all attribute values into the category object from the LD_CATEGORY table by the specified category IDs. This is how it works: ■ setCatID() is called to set the passed category ID to the current object. If no category ID is passed, the current $this->cid is taken. ■ The $this->dbi object is used to retrieve all the attribute values of the given category from the LD_CATEGORY table. ■ Each of the values is set to the current object so that they can be retrieved at any time using the other get methods of this class. For example $this- >CAT_NAME is set to the value of the CAT_NAME of the given category. ◆ getCategoryIDbyName(): This method returns the category ID for the given category name. It works as follows: ■ It takes the category name as parameter. ■ The category name is quoted using the quote() method of the $this- >dbi object and inserted into the SQL statement, which is needed to retrieve the category ID. ■ The query executes, and the resultant category ID is returned. If no result is found, it returns null. ◆ getCategories(): This method returns all the category names along with their IDs from the LD_CATEGORY table. This is how it works: ■ It executes a SQL query to retrieve all the field value of the LD_CATEGORY table ordered by descending CAT_ORDER. ■ The result is stored in an array that contains the category ID and name. ■ It returns the prepared array (or null, if the result set is empty). ◆ getPublishers(): This method returns the publisher IDs for a given category. This is how it works: ■ It calls setCatID() to set the passed category ID. ■ It executes a SQL query that retrieves all the publisher IDs from the LD_CAT_PUBLISHER table for the given category ID. ■ It stores the result of the execution in an array (unless the result set is empty), and returns the array. It returns null if the result set is empty. ◆ getViewers(): This method returns the viewer IDs for a given category. It works as follows: ■ It calls setCatID() to set the passed category ID. ■ It executes a SQL query that retrieves all the viewer IDs from the LD_CAT_VIEWER table for the given category ID. 252 Part II: Developing Intranet Solutions 11 549669 ch08.qxd 4/4/03 9:25 AM Page 252 ■ It stores the result of the execution in an array (unless the result set is empty), and returns the array. It returns null if the result set is empty. ◆ addCategory(): This method adds a new category into to the LD_CATE- GORY table. Category name, category ID, category order, and description are passed into an associative array as a parameter to the method. It works as follows: ■ The SQL statement is prepared using the $this->std_fields array that contains all the attributes of the LD_CATEGORY table and the values from the associative array that has been passed as parameter. ■ The values of the parameter are formatted using the quote() method of the $this->dbi object. ■ After executing the SQL statement, the newly added category’s CAT_ID is retrieved using another SQL statement. ■ If the insertion query is successful, this method returns the category ID of the newly added category. Otherwise, it returns FALSE. ◆ modifyCategory(): This method updates category information for a given category. Update information is passed in an associative array as a parameter to this method. It works as follows: ■ The SQL statement is prepared using the $this->std_fields array that contains all the attributes of the LD_CATEGORY table and the values from the associative array that has been passed as parameter. ■ The values of the parameter are formatted using the quote() method of the $this->dbi object. ■ If the update query is successful, this method returns TRUE. Otherwise, it returns FALSE. ◆ updateCategoryOrders(): This method updates the orders of the cate- gories. This takes an array of category ID and new order and assigns the new orders to each category. This is how it works for each category: ■ It updates the category by assigning it a temporary value (–1). This is done to avoid having the same order for two categories, which would forbid you to execute the query, because the ORDER attribute is unique. ■ After assigning the temporary value, the category is updated with the new order value for it. ■ The method returns TRUE upon successful update. Otherwise, it returns FALSE. Chapter 8: Intranet Simple Document Publisher 253 11 549669 ch08.qxd 4/4/03 9:25 AM Page 253 Method Description setCatID() Sets the category ID of the category object. It takes a non-empty category ID as the parameter. getCategoryName() Returns the name of the category object from the LD_CATEGORY table. It calls loadCatInfo() to set all the field properties of the class and then returns $this->CAT_NAME. getCategoryOrder() Returns the order of the category object from the LD_CATEGORY table. It calls loadCatInfo() to set all the field properties of the class and then returns $this->CAT_ORDER. getCategoryDesc() Returns the description of the category object from the LD_CATEGORY table. It calls loadCatInfo() to set all the field properties of the class and then returns $this->CAT_DESC. getHighestOrder() Returns the highest order of the LD_CATEGORY table. deleteCategory() Deletes the category from the database. It deletes all data related to the category from the ld_tool database. It takes the category ID as a parameter and returns TRUE or FALSE depending on the status of the deletion operation. deleteDocsByCatID() Deletes all document records related to a category. It takes category ID as a parameter and returns TRUE or FALSE depending on the status of the deletion operation. deleteCategoryViewers() Deletes all viewer records related to a category. It takes category ID as a parameter. deleteCategoryPublishers() Deletes all publisher records related to a category. It takes category ID as a parameter. isViewable() Determines if a category is viewable by a specific viewer. It takes category ID and user ID as parameters and returns TRUE if the user is authorized to view documents under the given category; otherwise, it returns FALSE. 254 Part II: Developing Intranet Solutions 11 549669 ch08.qxd 4/4/03 9:25 AM Page 254 Method Description isPublishable() Determines if the given publisher is allowed to publish in a specific category. It takes category ID and user ID as parameter and returns TRUE if the user is authorized to publish documents under the given category; otherwise, it returns FALSE. addCategoryPublishers() Adds publishers to a specific category. It takes category ID and user IDs as parameters and returns TRUE upon successful insertion of the data. It returns FALSE if it fails to add the publishers for the category. addCategoryViewers() Adds viewers to a specific category. It takes category ID and user IDs as parameters and returns TRUE upon successful insertion of the data. It returns FALSE if it fails to add the viewers for the category. The Doc class The Doc class provides the doc object, which is used to manipulate doc. It allows publishers to create and delete doc. The ch08/apps/class/class.Doc.php file in the CDROM is an implementation of this class. The following are the methods avail- able in this class: ◆ Doc(): This is the constructor method, which performs the following tasks: ■ Sets the object variable cat_tbl, which holds the category table name, to $LD_CATEGORY_TBL, which is loaded from the ld.conf file. ■ Sets the object variable doc_tbl, which holds the LD_DOCUMENT table name, to $LD_DOC_TBL, which is loaded from the ld.conf file. ■ Sets the object variable resp_tbl, which holds the response table name, to $LD_RESPONSE_TBL, which is loaded from the ld.conf file. ■ Sets the object variable track_tbl, which holds the track table name, to $LD_TRACK_TBL, which is loaded from the ld.conf file. ■ Sets an object variable called std_fields, which is an array that con- tains the LD_DOCUMENT table attributes and their data type. Chapter 8: Intranet Simple Document Publisher 255 11 549669 ch08.qxd 4/4/03 9:25 AM Page 255 . Interface PHP Application Framework Message Object Simple Intranet Document Publisher Applications Category Object Doc Object Response Object class.Message .php class.Category .php class.Doc .php class.Response .php Chapter. viewer table name from the ld.conf file. ■ Sets the object variable dbi to point to the class.DBI .php- provided object that is passed to the constructor by an application. The dbi member variable. allows an application to cre- ate, modify, and delete a category. The ch08/apps/class/class.Category .php file in the CDROM an implementation of this class. This class uses the following methods: ◆ Category():