Secure PHP Development- P92 docx

As you can see, you can easily click on the appropriate links to view the match- ing sections. Now let’s try a more complex search using the AND operator, as shown in Figure 12-5. Figure 12-5: A search with the AND operator. The search for “built-in and nature” found the results shown in Figure 12-6. Figure 12-6: Search results for “built-in and nature.” 426 Part II: Developing Intranet Solutions 15 549669 ch12.qxd 4/4/03 9:26 AM Page 426 Notice that previous searches are shown as recent search links. This allows you to view a previous search result without reentering the keywords. Also, if the appli- cation is used by other users, this will show you what are the most recent keywords that have been searched by other users. The help provided as the Help on Help System serves as a guide to how you can set up help for your own application. If you update your help files and want to regenerate the keyword index, you can run the makeindex.php script. This will update all applications. For example, Figure 12-7 shows a sample run of makeindex.php. Figure 12-7: Creating a keyword index for all applications. To limit creating an index to a single application, use app=application_name in the query string. For example, http://yourserver/help/apps/makeindex. php?app=self will only create an index for the help application itself. To create keyword indices for multiple but not all applications, use the URL calls such as: http://yourserver/help/apps/makeindex.php?app[]=app_name1&app[]=app_name2 Security Considerations Like all other applications you’ve developed in this book, the online help system has some security considerations that you need to be aware of. They are discussed here. Chapter 12: Online Help System 427 15 549669 ch12.qxd 4/4/03 9:26 AM Page 427 Restricting access to makeindex.php script The makeindex.php writes keyword index cache files in each application’s help directory. Therefore, you must make this directory writable by the Web server. Any time you have an application that is writing new files to your Web site, you need to ensure that this isn’t going be abused in any way. One of the best ways to protect against abuse is to make sure the application has limited access. You can limit the use of the makeindex.php to your own network by utilizing the following help.conf parameters: ACL_ALLOW_FROM and ACL_DENY_FROM. For example define(‘ACL_ALLOW_FROM’, ‘192.168.0.10’); define(‘ACL_DENY_FROM’, ‘0.0.0.0’); Here, the allow list specifies that access to makeindex.php is allowed from 192.168.0.10 and denied from every host of every network. The 0 octet in the net- work address in ACL_DENY_FROM can be thought of as “don’t care.” Because I spec- ified 0.0.0.0, I stated that I deny all hosts, and then I opened the access for 192.168.0.11. Similarly, if you want to allow everyone but deny one IP address, you can make configuration such as: define(‘ACL_ALLOW_FROM’, ‘0.0.0.0’); define(‘ACL_DENY_FROM’, ‘192.168.0.11,192.168.0.12’); Here access is allowed to everyone but 192.168.0.11 and 192.168.0.12. You can also specify network IP addresses when defining these rules. For example: define(‘ACL_ALLOW_FROM’, ‘192.168.0’); define(‘ACL_DENY_FROM’, ‘0.0.0.0’); Here access is granted for all hosts in the 198.168.0.x network. That means 192.168.0.1 to 192.168.0.254 can access the makeindex.php script. Summary In this chapter, you learned to develop an online help system that allows you to provide a central help facility for all your Web or intranet applications. It gives you a structured approach to designing online help for your applications, which is great for developers who are often reluctant to write help for the users. 428 Part II: Developing Intranet Solutions 15 549669 ch12.qxd 4/4/03 9:26 AM Page 428 Developing E-mail Solutions CHAPTER 13 Tell-a-Friend System CHAPTER 14 E-mail Survey System CHAPTER 15 E-campaign System Part III 16 549669 PP03.qxd 4/4/03 9:26 AM Page 429 16 549669 PP03.qxd 4/4/03 9:26 AM Page 430 . the keyword index, you can run the makeindex .php script. This will update all applications. For example, Figure 12-7 shows a sample run of makeindex .php. Figure 12-7: Creating a keyword index for. System 427 15 549669 ch12.qxd 4/4/03 9:26 AM Page 427 Restricting access to makeindex .php script The makeindex .php writes keyword index cache files in each application’s help directory. Therefore,. multiple but not all applications, use the URL calls such as: http://yourserver/help/apps/makeindex .php? app[]=app_name1&app[]=app_name2 Security Considerations Like all other applications you’ve