PHP ANTHOLOGY Book 2 -> Chapter 2 : Access Control 6.php

[djstudio]

there are some problem to the signup script from the book of harry fueck's. any body who has the work around to it ?

it seems that they used an old quickform class, so the fatal error
Call to undefined function: clearalltemplates(); line 71

anybody has the work around for this 6.php for access control?

[Raskolnikov]

i just downloaded the QuickForm version 3.1.1 and it works now

[Raskolnikov]

my problem is this. If a user hits the login button on the login page, and they did not input the correct Username and password, it reloads 4.php. But then it will not allow me to log in using the correct username and password.

my ideas are this: if i use the logout function, then everything is fine. so would there be a possibility that when incorrect info is inputed, then the session variables would still have the incorrect userid and password, and prevents me from subiting new session variables.

has anyone had these problems

[djstudio]

im using 3.2.1 and it doesnt work

[Kevin Yank]

I've asked Harry to drop in and have a look at this thread.

[HarryF]

OK - first off on HTML_QuickForm, as Raskolnikov points out, they've changed the API since the book was published, so you need to make completely sure you've got the right version. If you use;

pear uninstall HTML_QuickForm   # Make sure other versions are gone
pear install http://pear.php.net/get/HTML_QuickForm-3.1.1.tgz

Then it should work. They've changed the API for modifying the form "templates", which is what causes the "clearalltemplates()" error.

my ideas are this: if i use the logout function, then everything is fine. so would there be a possibility that when incorrect info is inputed, then the session variables would still have the incorrect userid and password, and prevents me from subiting new session variables.

No - in the login form, 4.php, if you place the following on lines 9-12;

session_start();

echo "<pre>";

print_r($_SESSION);

echo "</pre>"; 

You will see the current registered session variables (it will be empty if you do not have a valid login). Otherwise, if you look at the SPLIB/AccessControl/Auth.php class, and look at the login() method you will see that the storeAuth() method (which registers the session variables) is only called once a user has been successfully verified. A failed login will never result in session variables being stored.

my problem is this. If a user hits the login button on the login page, and they did not input the correct Username and password, it reloads 4.php. But then it will not allow me to log in using the correct username and password.

A question there - how did you create the signup? If you used the registration form, did you complete the whole process, confirming the email? Until the email is confirmed (via a URL), an account will not be created (which may be a problem - for Windows users, you need to set up your PHP smtp settings to use your ISP, so you get the email). If you examine (SELECT *) the user table after attempting to create an account, you should the new login.

An alternative approach to create an account is to cheat and create one directly on the database, using SQL;

INSERT into user SET login='harryf', password = md5('secretpass');

This works because MySQL supports the same encryption algorithm is PHP (md5). With that done you will be able to login via the form in 4.php.

The general approach to security, used by the Auth class, is to throw out users to a "dumb page" (4.php) which is just a form and is safely outside of the application. This approach helps prevent accidents where you create a condition where an invalid user has access to something they shouldn't.

That help at all?

[djstudio]

wow that was detailed~ =) thanks~ appreciate it. atleast i have some peace with the book. i can start creating a portal with ur technical help

[Raskolnikov]

H, thanks for the help. that all deffinitely makes sense.

this is what i have deducted from my attempts to fix this login problem.

when i am utilizing page 4.php to login, i am successfull. but when i am at page "4.php?from=" (i get this by tring to surf directly to 5.php) I am unsuccessfull.

Is there going to be a value for "from"? so far every time it shows up at the end of the url, there is no value to it. From what i can tell in the code, it should have a value = to the page location - REQUEST_URI, But nothing ever shows up in the addy line.

Would this cause a login issue??

[Kevin Yank]

Sounds like PHP isn't able to obtain a value for REQUEST_URI. One possible cause of this is that you might be running the CGI version of PHP (which is inefficient and lacks a number of features) instead of the Apache or IIS module version.

[HarryF]

The ?from= field the the Auth.php class generates is a "nive to have" feature - if someone is surfing your site, then has a break for a while, leaving their browser open, during which time their session times out, when they return they will be required to login again but the from value can help take them back to the page they were viewing.

As Kev points out, the from value is populated from $_SERVER['REQUEST_URI'] may not be available if you're using IIS or the CGI version of PHP. You can check where you have with the following;

echo php_sapi_name() 

When it comes to the login system, the form in 4.php has the following at the start;

// If $_GET['form'] comes from the Auth class

if ( isset ( $_GET['from'] ) ) {

    $target=$_GET['from'];

} else {

    // Default URL: usually index.php

    $target='5.php';

} 

That could be a little smarter in checking the value of $_GET['form'] - right now if $_GET['form'] is empty, it will still be assigned to the $target variable, which is used to specify where the form should submit it's values to - in other words it will result in the form posting to itself (hence you never get back to the secured page).

The following is a quick fix;

<?php

// If $_GET['form'] comes from the Auth class

if ( isset ( $_GET['from'] ) && !empty ( $_GET['from'] ) ) {

    $target=$_GET['from'];

} else {

    // Default URL: usually index.php

    $target='5.php';

}

?>

That now checks $_GET['from'] has a value. A more careful check might be to determine whether the file specified in the from field actually exists.

[Raskolnikov]

Frank, H, I think it is working. I have tested the login as many different ways as i can come up with and it works. I added the !empty portion of the if statement, and that seems to have worked.

when i php_sapi_name() it returned ISAPI. not totally for sure what that means, but i was pretty sure i did not install the CGI version of php.

new question. every other part of this access control is working fine. registering, confirming, changing password, however, I am now getting this error ('Fatal error: Call to a member function on a non-object in c:\SPLIB\AccessControl\AccountMaintenance.php on line 111') when accessing 10.php.

from accountMaintenance.php:

function resetPassword($login,$email) {

        $login=mysql_escape_string($login);

        $email=mysql_escape_string($email);

        $sql="SELECT ".USER_TABLE_ID.",

                  ".USER_TABLE_LOGIN.", ".USER_TABLE_PASSW.",

                  ".USER_TABLE_FIRST.", ".USER_TABLE_LAST."

              FROM

                  ".USER_TABLE."

              WHERE

                  ".USER_TABLE_LOGIN."='".$login."'

              AND

                  ".USER_TABLE_EMAIL."='".$email."'";

        $result=$this->db->query($sql);

        if ( $result->size() == 1 ) {

            $row=$result->fetch();

            if ( $password = $this->generatePassword() ) {

                $sql="UPDATE

                          ".USER_TABLE."

                      SET

                          ".USER_TABLE_PASSW."='".md5($password)."'

                      WHERE

                          ".USER_TABLE_ID."='".$row[USER_TABLE_ID]."'";

                $result=$this->dbConn->fetch($sql);

                if (!$result->isError()) {

                    $row[USER_TABLE_PASSW]=$password;

                    return $row;

                } else {

                    return false;

                }

            } else {

                return false;

            }

        } else {

            return false;

        }

    } 

I have deducted that in this line:

$result=$this->db->query($sql); 

the object db has not been initiated......according to the error message. However, as far as i can tell it has been instantiated from this line:

from 10.php:

// Instantiate MySQL connection

    $db= &new MySQL($host,$dbUser,$dbPass,$dbName);



    // Instantiate Account Maintenance class

    $aMaint=new AccountMaintenance($db); 

and this from accountMaintenance.php:

function AccountMaintenance (&$db) {

        $this->db=& $db;

    } 

any ideas as to why i would be getting that error message.

thanks for all your help so far it has been greatly appreciated!

[martinkuria]

Have tried to download the latest HTML_QuickForm, but still am getting the error:
Fatal error: Call to undefined method HTML_QuickForm::setRequiredNoteTemplate() in

I have tried to change the path all sort of things but still am stuck please assist

I am using QuickForm version 3.1.1 I have also tried 3.2.3, but nothing seem to work.

[EftheM]

Raskolnikov,

I have the exact same problem. Have you found a sollution up to now?

('Fatal error: Call to a member function on a non-object in c:\SPLIB\AccessControl\AccountMaintenance.php on line 111')

thnx in advance..

[googo1p1ex]

Anybody find out what was causing their 'Fatal error: Call to a member function on a non-object...' error? I'm having the same problem and have yet to figure it out.

Incidentally, anybody happen to notice the error in 9.php (for sending forgotten passwords)? I couldn't figure out what was going wrong when every time I used the page I got the message: 'Problem sending you details. Please contact the site administrators.' Then I noticed that, because the script is written to send the "An email has been sent to..." message if (!$mail->Send()) (notice the !), it does the exact opposite of what it should!

[Kevin Yank]

Thanks for spotting the spurious '!', googo1p1ex! I'll add that to the errata page of the book ASAP.

As for the fatal error some of you are experiencing, I've traced it to this line in AccountMaintenance.php:

                $result=$this->dbConn->fetch($sql); 

which should actually read:

                $result=$this->db->query($sql); 

I'll also add that to the errata.

[manjinder]

Originally Posted by Kevin Yank

Thanks for spotting the spurious '!', googo1p1ex! I'll add that to the errata page of the book ASAP.

As for the fatal error some of you are experiencing, I've traced it to this line in AccountMaintenance.php:

                $result=$this->dbConn->fetch($sql); 

which should actually read:

                $result=$this->db->query($sql); 

I'll also add that to the errata.

Hi !

i have been getting this msg when i have used HTML_QuickForm-3.2

Fatal error: Call to undefined function: updateattribute() in .../public_html/HTML_QuickForm-3.2.4pl1/QuickForm.php on line 256

whats that all about, im using the latest quickform and still get the same msg, it seems like the updateAttribute() does exist...

[Kevin Yank]

The code in the book is written for QuickForm 3.1, so if you want to solve the problem quickly I would suggest installing that older version.

That said, are you sure you've got the error message right? The line in question calls updateAttributes, not updateAttribute.

[kmillecam]

Hi Harry, Kevin;

Adding these fixes to the errata is nice but you solve a lot of our grief by fixing the sample files that are available for download. I just downloaded the files (15 Aug 2005) and the errors mentioned on this thread still exist.

Thanks,
Kevin

[Tecknowjnkie]

Here is beating a dead horse...

I installed 3.1.1 and I get this:

Fatal error: Only variables can be passed by reference in C:\PHP\PEAR\HTML\QuickForm.php on line 600

[Tecknowjnkie]

Update this error: Fatal error: Only variables can be passed by reference in C:\php\PEAR\HTML\QuickForm.php on line 600

occurs after upgrading PHP to verision 5.0.5

Harry is there a conflict between Quick_Form 3.1.1 with PHP 5.0.5?

If so is there a workaround we can implment short of trashing the script all together. I am using this access control class on a production machine.

[Kevin Yank]

I've recently uploaded an updated code archive for The PHP Anthology. Grab it and download it for many of the fixes mentioned above.

Tecknowjnkie, it definitely looks like PHP5 requires a more up-to-date version of QuickForm. Looks like you'll need to grab the latest version and then read the migration documentation to determine how to update the scripts to work with the current version.

[Tecknowjnkie]

Hi moonski

This is the same error I am receiving, did you read Kevin's reply above (msg#21)?

I am converting the classes per the migration directive at PEAR. As soon as I have it working I will post a detailed work through:-)

[moonski]

Originally Posted by Tecknowjnkie

Hi moonski

This is the same error I am receiving, did you read Kevin's reply above (msg#21)?

I am converting the classes per the migration directive at PEAR. As soon as I have it working I will post a detailed work through:-)

Thanks, I didn't see that reply until I had posted. I'm trying it right now as well.

[omcken]

Thanks
Reinstalling QuickForm resolved issue

[kgun]

There is also an error in 7.php that is not fixed in the last version of the code archive. I also had some configuration problems. I have the PHP, MySQL, phpMyAdmin, Apache server and PEAR library that followed with XAMPP Version 1.5.2 for Windows Xp home edition.

First I installed SPLIB and the pear libraries on the root folder and made the following config.php file:

<?php
ini_set('include_path',ini_get('include_path') . '../SPLIB:' . '../pear:');
?>


I posted the edited version of 7.php in this thread, post number 5:

OOP in PHP and MySQL tips: Start here. in the WPW Web Programming Discussion sub Forum.

I have the following remarsk to the two books.

Good enough on OO PHP.

Configuration information and updated / corrected versions of the SPLIB library to later versions of external libraries like pear could have been better. Since you supply an email address when you buy the books, there could have been automatic updating of important threads like this one and of the code library.

Since there is a chapter in volume II on the adapter pattern, is it not possible to adapt the code to later versions of pear? Proposal for revised editions of the books.

My own view if someboydy changes an important class like HTML_QuickForm in the pear library, the old methods should still function. New updated methods should be given another name.

Here are the most important changes in 7.php:

// The image check field
// Changed
$form->addElement('image',
' ',
'8.php',
'class="image"');

The change that starts with this line:

$renderer =& $form->defaultRenderer();

are changed in 6.php that I downloaded with the updated SPLIB.

It took some time for me to guess that there was an updated version of 6.php.

If you want to learn serious PHP, buy the books. Learn yourself Design patterns. Buy the following book:

Erich Gamma, Richard Helm, Ralph Johnson and John Vlissides (1995): "Design Patterns: Elements of Reusable Object-Oriented Software." Addison-Wesley Professional ISBN 0201633612