Part of the EllisLab Network
   
3 of 26
3
FreakAuth light 1.0.4 released
Posted: 16 May 2007 03:05 PM   [ Ignore ]   [ # 21 ]  
Lab Assistant
RankRank
Total Posts:  233
Joined  04-03-2007
grahack - 16 May 2007 02:55 PM

This is an item in the CI main config file, that you found (I guess) in config_demo.php.
Nothing to do with FAL. ‘config_demo.php’ is a demo for the main CI config file.

Are you sure?  I just checked.  I may be wrong, but that line appears in config_demo.php, but that line is NOT in the CI 1.5.3 distribution.  So that’s why I was asking, why this was added if it was not being used by FAL.
It does not cause any problems of course, I just didn’t see why modify the default config.php file unless necessary.

Profile
 
 
Posted: 16 May 2007 03:29 PM   [ Ignore ]   [ # 22 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  515
Joined  12-05-2006
a&w - 16 May 2007 03:05 PM
grahack - 16 May 2007 02:55 PM

This is an item in the CI main config file, that you found (I guess) in config_demo.php.
Nothing to do with FAL. ‘config_demo.php’ is a demo for the main CI config file.

Are you sure?  I just checked.  I may be wrong, but that line appears in config_demo.php, but that line is NOT in the CI 1.5.3 distribution.  So that’s why I was asking, why this was added if it was not being used by FAL.
It does not cause any problems of course, I just didn’t see why modify the default config.php file unless necessary.

@a&w
Sorry that config_demo.php was taken from CI_1.5.1 and we have forgotten to re-check if it is any different from the 1.5.3 one.
As far as I know, given that I tested everything on CI_1.5.3, the line you pointed out does not cause any problem in CI_1.5.3.

Feel free to remove it: we will update the config_demo.php file asap.

Dan

 Signature 

FreakAuth_light: pluggable & extendable authentication library that works on CI 1.5.X

CI SWIFT MAILER: 44% less memory than PHPMailer at double speed

Using Zend Framework components in Code Igniter

Profile
 
 
Posted: 16 May 2007 05:13 PM   [ Ignore ]   [ # 23 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  515
Joined  12-05-2006
Crimp - 16 May 2007 01:05 PM

I made a test installation of this today. A couple of issues:

The username validation does not seem to work as it should. Test: Leaving the username field blank does not generate any error messages, so validation then fails quite silently (email string passed back). I see the rule used, of course, but don’t quite see why it should fail silently with required in there. You may want to test this case yourself to see if it works as you intended.

Hey Crimp, welcome back tongue wink

I tested the demo auth.php controller and I couldn’t find what you are talking about.
Can you be a bit more detailed?
Are you speaking about the frontend or about the backend?

The second issue encountered is with custom user profiles. This is well explained in the tutorial on the site and easily implemented, in theory. However, the admin controller works as described, while custom fields added to the registration form (register.php) under auth are not set nor, obviously, validated. I am perhaps missing something basic here about how the values are passed around. It’s a lot of code to figure out at first sight. I’ll keep looking and learning.

You right Crimp: the custom userprofile stuff is not included (unluckily red face  ) in the FAL_front.php controller neither in the register.php view: I’ve forgotten and nobody has ever asked for it.
Anyway, if you need it immediately for your regitration (I’ll sort this out in next release) I suggest you to have a look at the following lines (pretty commented) of the application/controllers/admin/users.php (method add):

—> #243
—> #300

and in application/views/FreakAuth_light/template_admin/users/add.php at line

—> #8

And to extend the FAL_front class (FAL_front.php): maybe I post a tutorial soon.
I suggest to extend the class instead of just hacking i, because it will be easier to maintain it in your application in order to manage future FAL upgrades easily.

Finally, you have done a lot of very good work on this. I saw 3000+ downloads of your code this morning…and 1 whole euro in donations. Thinking the lingering 1 was a hardcoded remnant of the first beta, I dropped a few coins in the PayPal bucket. Lo and behold, that figure actually autoincrements!

I mean, CI people, c’mon. The FreakTeam has received just about enough for one beer and three straws…

...in fact we were a bit thirsty tongue wink
Funnily enough, we got 1 donation in 6 releases (first release end of Jan 2007), and today, with the 7th release, we finally got two more donations (3 donations in total): I personally thank you guys for the support!
As you might imagine… all this developement FreakAuth’s us a bit, and we get thirsty!

 Signature 

FreakAuth_light: pluggable & extendable authentication library that works on CI 1.5.X

CI SWIFT MAILER: 44% less memory than PHPMailer at double speed

Using Zend Framework components in Code Igniter

Profile
 
 
Posted: 17 May 2007 12:43 AM   [ Ignore ]   [ # 24 ]  
Research Assistant
RankRankRank
Total Posts:  423
Joined  10-02-2006
danfreak - 16 May 2007 05:13 PM

I tested the demo auth.php controller and I couldn’t find what you are talking about.
Can you be a bit more detailed? Are you speaking about the frontend or about the backend?

This is a gotta-run day…but it’s the front end - auth. Leave the username field blank and submit the form. No error message is returned for the username field. I was looking at the rules late yesterday and could not find a fault, but head on pillow later on I realized it may just be a missing error string. I’ll look again tonight.

The second case was, as mentioned, trying to implement the crud for user profiles by adding the custom fields to the registration form. I think this will be a useful feature, also for FAL, as it ensures that you collect ALL the required, including custom, information BEFORE creating an account. I understand now, like I observed, that the advertised crud was added to the backend admin only. It would certainly be a valuable addition to the front for the very reason mentioned above. Don’t you agree that hooking up a non-hacked custom registration form to the front controller is perhaps more important than having this ability as a backend admin?

 Signature 

CI version?
From SVN.

Profile
 
 
Posted: 17 May 2007 03:14 AM   [ Ignore ]   [ # 25 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  515
Joined  12-05-2006
Crimp - 17 May 2007 12:43 AM

This is a gotta-run day…but it’s the front end - auth. Leave the username field blank and submit the form. No error message is returned for the username field. I was looking at the rules late yesterday and could not find a fault, but head on pillow later on I realized it may just be a missing error string. I’ll look again tonight.

You right!
Now I understood what you mean!
Basically the message in views/FreakAuth_light/content/login.php at line 2 does not display.

<?=isset($this->fal_validation->login_error_message) ? $this->fal_validation->login_error_message : ''?>

This message says something like “wroong username or password”.
This error rule handles the case when a wrong username or password has been supplied.
I’m investigating and we will do a quick 1.0.5 release, because this is an important problem.
For important problem I don’t mean it is important in terms of security, but in terms of functionality for the end user.
The login_check() method of FAL_validation was introduced from FAL_1.0.3, and has the purpose to validate username and password simultaneusly instead of diplaying individual error messages. This improves security given that the potential malicious man that is attempting to login does not know if he entered a wrong username or a wrong password.
I’ll keep you posted about this issue.

The second case was, as mentioned, trying to implement the crud for user profiles by adding the custom fields to the registration form. I think this will be a useful feature, also for FAL, as it ensures that you collect ALL the required, including custom, information BEFORE creating an account. I understand now, like I observed, that the advertised crud was added to the backend admin only. It would certainly be a valuable addition to the front for the very reason mentioned above. Don’t you agree that hooking up a non-hacked custom registration form to the front controller is perhaps more important than having this ability as a backend admin?

About the custom userprofile issue I now remember why I did not included them into the registration form.
I did not do it, because I thought that in most of the cases people want a fast registration, and then, after registering will complete some additional, and often not required for registration, personal informations.
That why I introduced the my_account controller as explained in the custom userpofile tutorials.

Nevertheless I found myself using several custom fields right for registration like in this example.

 Signature 

FreakAuth_light: pluggable & extendable authentication library that works on CI 1.5.X

CI SWIFT MAILER: 44% less memory than PHPMailer at double speed

Using Zend Framework components in Code Igniter

Profile
 
 
Posted: 17 May 2007 03:39 AM   [ Ignore ]   [ # 26 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  515
Joined  12-05-2006
Crimp - 17 May 2007 12:43 AM

This is a gotta-run day…but it’s the front end - auth. Leave the username field blank and submit the form. No error message is returned for the username field. I was looking at the rules late yesterday and could not find a fault, but head on pillow later on I realized it may just be a missing error string. I’ll look again tonight.

Quick update:
A temporarily solution to this problem is to turn CAPTCHA off for login in application/config/freakauth_light.php #138

$config['FAL_use_security_code_login'] = FALSE;

Still investigating to make login error messages working even with CAPTCHA

 Signature 

FreakAuth_light: pluggable & extendable authentication library that works on CI 1.5.X

CI SWIFT MAILER: 44% less memory than PHPMailer at double speed

Using Zend Framework components in Code Igniter

Profile
 
 
Posted: 17 May 2007 04:00 AM   [ Ignore ]   [ # 27 ]  
Research Assistant
Avatar
RankRankRank
Total Posts:  515
Joined  12-05-2006
Crimp - 17 May 2007 12:43 AM

This is a gotta-run day…but it’s the front end - auth. Leave the username field blank and submit the form. No error message is returned for the username field. I was looking at the rules late yesterday and could not find a fault, but head on pillow later on I realized it may just be a missing error string. I’ll look again tonight.

SORTED OUT! (I hope…)

Well, there were 2 small missing else conditions in the method securitycode_check($value) in the FAL_validation.php library

in application/libraries/FAL_validation.php substitute the method securitycode_check($value) with the following code:

// --------------------------------------------------------------------
    
    /**
     * RULES HELPER FUNCTION
     * Security code validation callback for validation
     *
     * @access private
     * @param varchar $value
     * @return boolean
     */
    
function securitycode_check($value)
    
{
        
if ($this->CI->config->item('FAL_use_security_code_register') OR $this->CI->config->item('FAL_use_security_code_login') OR $this->CI->config->item('FAL_use_security_code_forgot_password'))
        
{
            
//gets the security code stored in the db_session
            
$securityCode = $this->CI->db_session->userdata('FreakAuth_security_code');
            
            
// erase the code from the session to prevent it to be used a second time
            // see http://www.ciforge.com/trac/freakauth/ticket/20
            
$this->CI->db_session->unset_userdata('FreakAuth_security_code');
            
            if (
$this->CI->config->item('FAL_security_code_case_sensitive')==FALSE)
            
{
                $control
= strcmp(strtolower($value), strtolower($securityCode));
            
}
            
else {$control= strcmp($value, $securityCode);}
            
            
//compares the security code provided in the input field with that stored in db_session
            
if ($control != 0)
            
{
                $this
->set_message('securitycode_check', $this->CI->lang->line('FAL_captcha_message'));
                return
false;
            
}
            
else
            
{
                
return true;
            
}
        }
        
else
        
{
            
return true;
        
}
    }

Let me know if it works for you!

smile

 Signature 

FreakAuth_light: pluggable & extendable authentication library that works on CI 1.5.X

CI SWIFT MAILER: 44% less memory than PHPMailer at double speed

Using Zend Framework components in Code Igniter

Profile
 
 
Posted: 17 May 2007 06:51 AM   [ Ignore ]   [ # 28 ]  
Lab Assistant
RankRank
Total Posts:  233
Joined  04-03-2007
danfreak - 17 May 2007 03:14 AM
Crimp - 17 May 2007 12:43 AM

The second case was, as mentioned, trying to implement the crud for user profiles by adding the custom fields to the registration form. I think this will be a useful feature, also for FAL, as it ensures that you collect ALL the required, including custom, information BEFORE creating an account. I understand now, like I observed, that the advertised crud was added to the backend admin only. It would certainly be a valuable addition to the front for the very reason mentioned above. Don’t you agree that hooking up a non-hacked custom registration form to the front controller is perhaps more important than having this ability as a backend admin?

About the custom userprofile issue I now remember why I did not included them into the registration form.
I did not do it, because I thought that in most of the cases people want a fast registration, and then, after registering will complete some additional, and often not required for registration, personal informations.

I like the ‘simple’ registration, and then complete additional information afterwards.  A middle ground to the situation might be to redirect the user on first login to complete the custom or additional fields.  Maybe the roadmap for FAL might include yet another config toggle ohh as to whether the administrator wants the custom / additional fields completed at the initial registration stage or the secondary stage after the first log in.  This behavior would be similar to registering on CIForge.

Profile
 
 
Posted: 17 May 2007 07:58 AM   [ Ignore ]   [ # 29 ]  
Lab Assistant
RankRank
Total Posts:  233
Joined  04-03-2007

A few miscellaneous suggestions:

config_demo.php

$config['sess_cookie_name']    = 'FreakAuth';//add a comment if name can be changed, or why this is needed
$config['sess_expiration']     = 7200;
$config['sess_encrypt_cookie'] = TRUE; //FAL has TRUE (CI distribution = FALSE)
$config['sess_use_database']   = TRUE; //FAL requires TRUE (CI distribution = FALSE)
$config['sess_table_name']     = 'ci_sessions';
$config['sess_match_ip']       = FALSE;
$config['sess_match_useragent']= FALSE;//FAL has FALSE (CI distribution = FALSE)

Basically I’m suggesting adding a few comments for education and perhaps highlighting changes from the ‘default’ CI distribution.  When I modified my existing site, I did not just copy the entire file, I used config_demo as an example and I missed changing ‘sess_use_database’.  All that I am saying is that a few comments would help educate about FAL.

A couple of very petty / insignificant changes to:

//installer.php
Old Line 56:   $data['message'].='<p>After creating you DB, ...
New Line 56:   $data['
message'].='<p>After creating your DB, ...

//freakauth_demo.php
Old Lines 19&20:
$data['message'].='<div id="flashMessage"><p>If you think that this library saved you time, or helped you '."\n";
$data['message'].=' making money quicker, or you simply like it, please help its future development and maintenance making a <a href="http://www.4webby.com/freakauth" target="_blank">donation.</p>';
New
Lines 19&20: (corrects some english spelling, grammar, and adds link to donate)
$data['message'].='<div id="flashMessage"><p>If you think that this library saved you time, helped you '."\n";
$data['message'].=' make money quicker, or you simply like it, please help its future development and maintenance by making a <a href="http://www.4webby.com/freakauth" target="_blank">donation.</p>';

Installer
The “installer” is very nice.

I did a clean install of FAL on a clean CI download and had no problems.  I applied FAL on an existing site and experienced difficulties. I started debugging and found the source of the problem, that I forgot to set the

$config['sess_use_database']    = TRUE; //Required for FAL

I made the mistake of not opening the installer page and instead just opened the root of the site which of course gave errors.  My point here is to say that the installer is great.

For future releases you might consider checking out BambooInvoice if you have not already.  Derek has a clever installer routine as well and it installs the DB as well.  Basically just check if table exists and if not add it.  Maybe the DB install routine isn’t directly a part of your ‘installer’ but within the installer in the checks for the DB where it checks if the required tables exists you have links that go to a controller method that installs those tables.  I am not saying to do something exactly like the BambooInvoice installer.  I’m just saying to take a look at it for the logic as it has a few features that could be easily implemented here for improvement.  I can elaborate further if you don’t want to bother with downloading, but that might defeat the purpose because if you download it and run the installer you’ll experience exactly what I’m talking about very quickly and you can check out the installer if you want later.

I went ahead and inserted some snippets from the relevant code to make it easier.

This is install.php which is at the same level as the main index.php.  As you can see it just launches the installer.

<?php
Header
("Location: index.php/install");
// Bamboo utilizes an MVC pattern, and thus calling "index.php/install" is really calling the
// file install.php from the system/controllers directory.
?>
<?php
/*
This install controller is only for quick insertion of an admin user into the system.
I strongly recommend you delete this file after you've installed BambooInvoice.
This controller is not in any way needed to run the application.
*/

class Install extends Controller {
    
function __construct()
    
{
        parent
::Controller();
        
$this->load->library('encrypt');
        
$this->load->dbutil();
    
}
    
    
function index()
    
{
        $admin_email
= 'you@email.com'; // change this to a different username if you want
        
$admin_firstname = 'first_name';
        
$admin_lastname = 'last_name';
        
        
// -----------------------------
        // Setting your admin password
        // -----------------------------
        // If you'd prefer to set your password to a specific word rather then a random string
        // uncomment the second line... if you'd prefer a randmom, uncomment the first
        // $admin_password = substr(sha1(rand(0,999)), 0, 8); // generate random password
        
$admin_password = 'demo';

        
/*
        * You shouldn't need to modify anything beneath here
        */

        
if (!isset($admin_password) || !isset($admin_email)) {
            
die ("Please first define your admin login, email and password.  Instructions for this are located in the file /bamboo_system_files/application/controllers/install.php");
        
}

        
if (!$this->db->table_exists('some_table')) {
            $this
->db->query("CREATE TABLE 'some_table' (
                          `session_id` varchar(40) NOT NULL default '0',
                          `ip_address` varchar                          PRIMARY KEY  (`session_id`)
                        ) TYPE=MyISAM;"
);
Profile
 
 
Posted: 17 May 2007 08:10 AM   [ Ignore ]   [ # 30 ]  
Lab Assistant
RankRank
Total Posts:  233
Joined  04-03-2007

I came across these because I had error reporting set to ALL.  While you are making your updates you might check you have reporting set to ALL?

controllers/admin/admins.php

Old Line 90-91:   $config['base_url'] = site_url(’admin/admins’);
     
// uses apostrophe instead of single quote
New Line 90-91:   $config['base_url'] = site_url('admin/admins');
     
// use single quote

controllers/admin/users.php

Old Line 90-91:   $config['base_url'] = site_url(’admin/users’);
     
// uses apostrophe instead of single quote
New Line 90-91:   $config['base_url'] = site_url('admin/users');
     
// use single quote
Profile
 
 
   
3 of 26
3
 
Post Marker Legend
New Topic New posts Hot Topic Hot Topic with new posts New Poll New Poll Moved Topic Moved Topic Sticky Topic Sticky topic
Old Topic No new posts Hot Old Topic Hot Topic with no new posts Old Poll Old Poll Closed Topic Closed Topic Announcement Announcements
Theme
Change Theme
Visitor Statistics
The most visitors ever was 721, on January 06, 2010 09:38 AM
Total Registered Members: 119125 Total Logged-in Users: 62
Total Topics: 125465 Total Anonymous Users: 4
Total Replies: 660486 Total Guests: 459
Total Posts: 785951    
Members ( View Memberlist )
Newest Members:  kracha95tanjahagresifBlunklenarezecomodlostunlockedmarcusbrody10ghadbanRachelRiley