Secure PHP Development- P43 pdf

$thisApp = new userManagerApp(
array( ‘app_name’ => $APPLICATION_NAME,
‘app_version’ => ‘1.0.0’,
‘app_type’ => ‘WEB’,
‘app_db_url’ => $APP_DB_URL,
‘app_auto_authorize’ => FALSE,
‘app_auto_connect’ => TRUE,
‘app_auto_chk_session’ => FALSE,
‘app_debugger’ => $ON
)
);
//$thisApp->buffer_debugging();
$thisApp->run();
//$thisApp->dump_debuginfo();
?>
Configuring user administration applications
The user manager application and all the other applications in the user manage-
ment system require configuration information that is stored in user_mngr.conf.
Table 6-2 shows the configuration settings.
TABLE 6-2 USER MANAGER CONFIGURATION
Variable Purpose
$PEAR_DIR Set to the directory containing the PEAR
package; specifically the DB module needed for
class.DBI.php in our application framework.
$PHPLIB_DIR Set to the PHPLIB directory, which contains the
PHPLIB packages; specifically the
template.
inc
package needed for template manipulation.
$APP_FRAMEWORK_DIR Set to our application framework directory.
Continued

Chapter 6: Central User Management System 181
09 549669 ch06.qxd 4/4/03 9:24 AM Page 181
TABLE 6-2 USER MANAGER CONFIGURATION (Continued)
Variable Purpose
$PATH Set to the combined directory path consisting of
the
$PEAR_DIR, the $PHPLIB_DIR, and the
$APP_FRAMEWORK_DIR. This path is used with
the
ini_set() method to redefine the
php.ini entry for include_path to include
$PATH ahead of the default path. This allows
PHP to find our application framework, PHPLIB,
and PEAR-related files.
$AUTHENTICATION_URL Set to the central login application URL.
$LOGOUT_URL Set to the central logout application URL.
$APPLICATION_NAME The internal name of the application.
$DEFAULT_LANGUAGE Set to the default (two character) language
code.
$DEFAULT_DOMAIN Set to the default domain of the user. This
domain is appended when the user does not
specify the fully qualified username
(
user@host) during interaction with the user
management applications.
$ROOT_PATH Set to the parent directory within the Web
server’s document root where the user-
manager-specific directory exists as a
subdirectory.
$REL_APP_PATH The relative application path as seen from Web

browser.
$TEMPLATE_DIR Set to the template directory containing the
ihtml template files needed for the user
management applications.
$CLASS_DIR Set to the class directory where user-
management-related class files are stored.
$USER_CLASS Fully qualified pathname for the User class.
$MIN_USERNAME_SIZE Minimum user name (EMAIL) size.
$MIN_PASSWORD_SIZE Minimum password size.
182 Part II: Developing Intranet Solutions
09 549669 ch06.qxd 4/4/03 9:24 AM Page 182
Variable Purpose
$DUMMY_PASSWD Dummy password used during account
modification step.
$ROOT_USER Fully qualified username of the root user
$SECRET A secret random number used in checksum
generation, which is used when forgotten
password URL links are sent via e-mail.
$CHAR_SET Default character set to be used in e-mail
content type header.
$USERMNGR_MNGR Name of the user manager application.
$USERMNGR_FORGOTTEN_APP Name of the forgotten password application.
$USERMNGR_CHANGE_PWD_APP Name of the change password application.
$REL_TEMPLATE_DIR Relative path to the template directory as seen
from the Web.
$APP_DB_URL The fully qualified database URL needed to
access the user database.
$USER_TBL Name of the user table.
$STATUS_TEMPLATE Name of the status information display
template.

$USERMNGR_MENU_TEMPLATE Name of the user management menu template.
$USERMNGR_USER_TEMPLATE Name of the user add/modify form template.
$USERMNGR_PWD_REQUEST_TEMPLATE Name of the password change template.
$USERMNGR_PWD_EMAIL_TEMPLATE Name of the e-mail template, which is used to
send the e-mail message for forgotten
passwords.
$USERMNGR_PWD_RESET_TEMPLATE Name of the forgotten password reset template.
$USERMNGR_PWD_CHANGE_TEMPLATE Name of the password change template.
$ADMINISTRATIVE_USER Numeric type value for administrative user.
$STANDARD_USER Numeric type value for standard user.
$USER_TYPE Associative array defining the relationship
between the numeric user type and user type
labels.
Chapter 6: Central User Management System 183
09 549669 ch06.qxd 4/4/03 9:24 AM Page 183
Listing 6-3 shows the configuration file (user_mngr.conf).
Listing 6-3: user_mngr.conf
<?php
// Turn on all error reporting
error_reporting(E_ALL);
// If you have installed framework directory in
// a different directory than
// %DocumentRoot%/framework, change the setting below.
$APP_FRAMEWORK_DIR=$_SERVER[‘DOCUMENT_ROOT’] . ‘/framework’;
$PEAR =$_SERVER[‘DOCUMENT_ROOT’] . ‘/pear’;
$PHPLIB =$_SERVER[‘DOCUMENT_ROOT’] . ‘/phplib’;
// Insert the path in the PHP include_path so that PHP
// looks for PEAR, PHPLIB and our application framework
// classes in these directories
ini_set( ‘include_path’, ‘:’ .

$PEAR . ‘:’ .
$PHPLIB . ‘:’ .
$APP_FRAMEWORK_DIR . ‘:’ .
ini_get(‘include_path’));
$AUTHENTICATION_URL = “/login/login.php”;
$LOGOUT_URL = “/logout/logout.php”;
$APP_MENU = ‘/home/home.php’;
$APPLICATION_NAME = ‘USER_MNGR’;
$XMAILER_ID = ‘Example User Manager Version 1.0’;
$DEFAULT_LANGUAGE = ‘US’;
$DEFAULT_DOMAIN = ‘example.com’;
$ROOT_PATH = $_SERVER[‘DOCUMENT_ROOT’];
$REL_ROOT_PATH = ‘/user_mngr’;
$REL_APP_PATH = $REL_ROOT_PATH . ‘/apps’;
$TEMPLATE_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/templates’;
$CLASS_DIR = $ROOT_PATH . $REL_APP_PATH . ‘/class’;
$REL_TEMPLATE_DIR = $REL_APP_PATH . ‘/templates/’;
184 Part II: Developing Intranet Solutions
09 549669 ch06.qxd 4/4/03 9:24 AM Page 184
require_once “user_mngr.errors”;
require_once “user_mngr.messages”;
require_once ‘DB.php’;
require_once $APP_FRAMEWORK_DIR . ‘/’ . ‘constants.php’;
require_once $APP_FRAMEWORK_DIR . ‘/’ . $APPLICATION_CLASS;
require_once $APP_FRAMEWORK_DIR . ‘/’ . $ERROR_HANDLER_CLASS;
require_once $APP_FRAMEWORK_DIR . ‘/’ . $AUTHENTICATION_CLASS;
require_once $APP_FRAMEWORK_DIR . ‘/’ . $DBI_CLASS;
require_once $APP_FRAMEWORK_DIR . ‘/’ . $USER_CLASS;
require_once $TEMPLATE_CLASS;
$MIN_USERNAME_SIZE= 3;

$MIN_PASSWORD_SIZE= 3;
$DUMMY_PASSWD = ‘1234567890’;
$ROOT_USER = ‘’;
$SECRET = 916489;
$CHAR_SET = ‘charset=iso-8859-1’;
// Application names
$USERMNGR_MNGR = ‘user_mngr.php’;
$USERMNGR_FORGOTTEN_APP = ‘user_mngr_forgotten_pwd.php’;
$USERMNGR_CHANGE_PWD_APP = ‘user_mngr_passwd.php’;
/* START TABLE NAMES */
$APP_DB_URL = ‘mysql://root:foobar@localhost/auth’;
$AUTH_DB_TBL = ‘users’;
/* END TABLE NAMES */
$STATUS_TEMPLATE = ‘usermngr_status.html’;
$USERMNGR_MENU_TEMPLATE = ‘usermngr_menu.html’;
$USERMNGR_USER_TEMPLATE = ‘usermngr_user_form.html’;
$USERMNGR_PWD_REQUEST_TEMPLATE= ‘usermngr_forgotten_pwd.html’;
$USERMNGR_PWD_EMAIL_TEMPLATE = ‘usermngr_forgotten_pwd_email.html’;
$USERMNGR_PWD_RESET_TEMPLATE = ‘usermngr_pwd_reset.html’;
$USERMNGR_PWD_CHANGE_TEMPLATE = ‘usermngr_pwd_change.html’;
$ADMINISTRATIVE_USER = 9;
$STANDARD_USER = 1;
$USER_TYPE = array(‘9’ => ‘Administrator’, ‘1’ => ‘Standard User’);
?>
Make sure you change this file to adjust the file and directory path information
as needed.
Chapter 6: Central User Management System 185
09 549669 ch06.qxd 4/4/03 9:24 AM Page 185