[ZendTo] Re: Duplicated insert

Sergio Rabellino rabellino at di.unito.it
Thu Aug 12 11:19:55 BST 2010



Jules ha scritto:
>
>
> On 11/08/2010 23:15, Sergio Rabellino wrote:
>>
>>
>> Jules ha scritto:
>>> On 09/08/2010 12:48, Sergio Rabellino wrote:
>>>   
>>>> In my code-checks i've found that the auth code is inserted twice and 
>>>> only the latest is used.
>>>> I suggest to remove in lib/Verify.php the lines from 163 to 168.
>>>>     
>>> Where is the other instance?
>>>   
>> It's in Verify.php too, line 219, but in another func.
> It's not quite as simple as that, as in the sub initWithFormData 
> called from "new Verify()" it is needed when approving an 
> authenticated user who doesn't get send the email. So if anything, it 
> should be removed from the code that sends the email 
> $verify->sendVeryifyEmail() and not from initWithFormData().
> Do you agree?
hmmm. Why do you need an auth entry for an authenticated user ? I didn't 
find a situation where it's needed. I did two dropoffs either with an 
authenticated user or an unauthenticated one, both of them successfully.
> I'm going to leave it alone for now as it doesn't actually cause any 
> damage at all, but I would like to hear your thoughts on the question.
>>
>>>> A question: there is any reason about the removal of any international 
>>>> chars from name and organization ?
>>>>     
>>> Me being paranoid about people putting nasty characters into databases 
>>> and HTML.
>>>   
>>>> I've adapted my code to write down utf8 strings into mysqldb
>>>>     
>>> How do I do that?
>>>   
>> First of all the tables must be created/altered to support utf8 
>> chars: I did an alter from phpmyadmin setting the collation tu 
>> utf8-general-ci (case insensitive). Then creating the connection to 
>> the db, the first sql statement is
>>
>> DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;
>>
>> to be sure that client and server share the same charset. (If you are 
>> paranoid, you can lately check if it's true, asking thru php the 
>> current charset/collation).
>> Then the code must be changed, encoding/decoding the strings from/to 
>> web forms, removing also the regex check for user typing.
>> If all of this convince you, i can send all the changes (8/10 lines 
>> somewhere).
>> As far as i know, utf8 is backward compatible to ascii chars, so no 
>> dual code is required, and today asking for an utf8 mysql table it's 
>> a must for many (L)AMP apps.
> I'm not wholly convinced, but send me the code anyway, so I can put it 
> in (possibly commented-out for now).
First of all, the tables fields must be created (or altered if exists) 
adding  "character set utf8 " after the field type (I did it simply from 
phpmyadmin :-) ).
My code changes follow. The line numbers can be slightly different as i 
frequently add some tag lines to the code...

file lib/MySQL.php
add below  line 54
 >  // SET CHARSET
 >  $query = "DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;";
 >  if (!$this->database->query($query)) {
 >   return "FALSE";
 >  }

file lib/NSSDropbox.php
change line 1152 to  $name = utf8_decode($recordlist[0]['FullName']);
change line 1155 to  $org   = utf8_decode($recordlist[0]['Organization']);

file lib/NSSDropoff.php
change line 936 to       $this->_senderName          = 
utf8_decode($qResult['senderName']);
change line 937 to      $this->_senderOrganization  = 
utf8_decode($qResult['senderOrganization']);
change line 939 to      $this->_note                = 
utf8_decode($qResult['note']);
change line 1239 to    utf8_encode($senderName), 
utf8_encode($senderOrganization), $senderEmail,
change line 1243 to  utf8_encode($note)) ) {

file lib/Verify.php
add below line 213
    $senderName = utf8_encode($senderName);
    $senderOrganization = utf8_encode($senderOrganization);
change line 236 to  $smarty->assign('senderName',  
utf8_decode($senderName));
change line 237 to  $smarty->assign('senderOrg',   
utf8_decode($senderOrganization));

With these changes, i can use utf8 chars (i.e. à ì) into username, 
organization and note.

>
>>>> and i do not see any evidence of problem about it: i'm wrong ?
>>>>     
>>> I just want to be absolutely doubly sure that people cannot put evil 
>>> text in it, which is very easy to allow by mistake.
>>>
>>>   
>> I understand, but in italian language (and in many other languages) 
>> the 'special' chars are often used: university-> università ....
> Ah, that does explain a good use for it, which definitely helps 
> convince me :-)
Ah, i forgot to mention a possibly interesting change into 
lib/NSSLDAPAuthenticator.php: can happen that you can't login as 
anonymous into an ldap server (my university central server is 
configured without anon query), so can be useful adding an optional 
username/password for ldap binding.

config/preferences.php
add two prefs as follow
 'authLDAPDn'            => 'o=MyOrg,uid=MyUser',
 'authLDAPPass'          => 'MyPASStoLDAP',

lib/NSSLDAPAuthenticator.php
add below line 50
 >  protected $_ldapDn = NULL;
 >  protected $_ldapPass = NULL;
add below line 73
 >   $this->_ldapDn        = $prefs['authLDAPDn'];
 >   $this->_ldapPass      = $prefs['authLDAPPass'];

change line 147 to   if ( $ldapBind = 
@ldap_bind($ldapConn,$this->_ldapDn,$this->_ldapPass) ) {
change line 230 to     if ( $ldapBind = 
@ldap_bind($ldapConn,$this->_ldapDn,$this->_ldapPass) ) {

If you setup the two preferences with empty string, the bind will be 
anonymous, as before these changes.
hope this helps.
>
>>> Jules
>>>
>>>   
>> I hope my written english it's enough to be understood.
> No problem there!
>
> Cheers,
> Jules
>
> -- 
> Julian Field MEng CITP CEng
> www.ZendTo.com
>
> Need help fixing or optimising your systems?
> Contact me!
> Need help getting you started solving new requirements from your boss?
> Contact me!
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
> Follow me at twitter.com/JulesFM
>   
> ------------------------------------------------------------------------
>
> _______________________________________________
> ZendTo mailing list
> ZendTo at zendto.com
> http://mailman.ecs.soton.ac.uk/mailman/listinfo/zendto
>   

-- 
Ing. Sergio Rabellino

Università degli Studi di Torino
Dipartimento di Informatica
ICT Services Director
Tel +39-0116706701  Fax +39-011751603
C.so Svizzera , 185 - 10149 - Torino

<http://www.di.unito.it>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ecs.soton.ac.uk/pipermail/zendto/attachments/20100812/ec95f893/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logo.jpg
Type: image/jpeg
Size: 4570 bytes
Desc: not available
Url : http://mailman.ecs.soton.ac.uk/pipermail/zendto/attachments/20100812/ec95f893/attachment-0001.jpg 


More information about the ZendTo mailing list