Secure PHP Development- P51 pot

Variable Values
$TIP_SCRIPT Point the tip script (tip_script.js), which is needed to
show tips.
$TIP_URL Point to the relative path, which is the parent of the tips
directory.
$DEFAULT_THEME Set to the default theme ID. By default, the theme is set to 1.
$USER_DEFAULTS Point to an array that contains default preferences of all users.
$MAX_AVAILABLE_TIP Set to the maximum number of tips that are available in the
tips directory within the templates directory.
$ADMIN_MSG_COLOR Set the color shown to the viewers with administrative
privileges.
$STANDARD_MSG_COLOR Set the color shown to the standard viewers.
$OFFICE_START_TIME Set to the expected office start time, such as 10 (for 10 a.m.).
$LUNCH_START_TIME Set the expected start time for lunch, such as 13 (for 1 p.m.;
remember, we’re using a 24-hour format).
$LUNCH_END_TIME Set to the expected lunch end time, such as 14 (for 2 p.m.).
$OFFICE_END_TIME Set to the expected office end time, such as: 19 (for 7 p.m.).
$DEFAULT_REPORT_TYPE Set the default report type: MONTHLY, WEEKLY, or DAILY.
$ACCESS_REPORT_ Set the color for the even rows of the report. The color value
EVEN_ROW_COLOR is in HTML color format (RGB).
$ACCESS_REPORT_ Set the color for the odd rows of the report. The color value
ODD_ROW_COLOR is in HTML color format (RGB).
$ACCESS_RPT_OFFICE_ Set the text color for the regular office hours of the access
HR_TEXT_COLOR_REGULAR report. The color value is in HTML color format (RGB).
$ACCESS_RPT_OFFICE_HR_ Set the text color for the extra office hours of the access
TEXT_COLOR_IRREGULAR report. The color value is in HTML color format (RGB).
$ADMIN_TYPE Set the user type value that will indicate an administrative
user level. The default value of
9 is okay.
$EXPECTED_OFFICE_HRS Set to the daily office hours that are expected to be maintained
by every employee. The default is set to

8 hours per day.
Continued
Chapter 7: Intranet System 221
10 549669 ch07.qxd 4/4/03 9:25 AM Page 221
TABLE 7-2 HOME.CONF SETTINGS (Continued)
Variable Values
$GRACE Set to the grace period (in seconds). The default value is 600
seconds (10 minutes). This means that if an employee fails to
meet the full office hours requirements by 10 minutes or less,
the grace period is applied to make up her full office hours.
$WEEKEND Set to the day(s) of the week that is/are considered as
weekend. The default values (
‘Sat’, ‘Sun’) should be
standard for most places on this planet. Keep the default.
Setting Up the Application
Templates
The HTML interface templates needed for the applications are included on the
CD-ROM. These templates contain various template tags to display necessary infor-
mation dynamically. The templates are named in the home.conf file. Table 7-3
explains the purpose of each template.
TABLE 7-3 HTML TEMPLATES
File Name Purpose
home.html Home page template of intranet.
home_status.html Shows status messages when user performs an
operation such as updating preference settings.
access_report.html Used to display an access report.
add_msg.html Used to add an intranet message.
msg_mngr.html Shows message-management options to users.
msg_preview.html Shows the preview of a message to users.
preference.html Shows the theme preference page.

log_detail.html Shows the log details for a day.
admin_access_report.html Shows the access report to administrators.
222 Part II: Developing Intranet Solutions
10 549669 ch07.qxd 4/4/03 9:25 AM Page 222
These templates also use images that are stored in an image directory called
images within the template directory pointed by the $TEMPLATE_DIR variable in the
home.conf file.
Intranet Home Application
The home.php application is responsible for displaying an intranet home page to
each user. The application is included on the CD-ROM in the ch07/apps directory.
home.php implements the following functionality:
◆
It displays the intranet home page to each user after the user is logged in.
◆
It uses the home page to show any message(s) that the user needs to view.
◆
When the user clicks the OK button of a message (to indicate that he has
read the message), the application updates the message-tracking table so
that the same message is not displayed again.
This application has the following methods:
◆
run(): This method is responsible for running the application. This
method does the following:
■
If the user is not authenticated, it displays an alert message and returns
the user to previous page. This effectively terminates the application.
■
If the user is authenticated, it creates a theme object, $this-
>themeObj
.

■
The current user’s theme choice is stored in $this->theme by calling
the getUserTheme() method of the theme object created.
■
When the user comes to the home application after clicking the OK
button to indicate that she has read a message, this method calls the
updateMsgTrack() method.
■
Then the displayHome() method is called to display the intranet home
page.
◆
displayHome(): This method displays the home page of the intranet sys-
tem and also shows specific messages to specific users. Here is how it
works:
■
It applies the appropriate theme to the page.
■
It checks whether tips are to be shown to the user and sets tip informa-
tion accordingly.
■
It sets the photo of the user who has requested this page.
Chapter 7: Intranet System 223
10 549669 ch07.qxd 4/4/03 9:25 AM Page 223
■
It sets the current date and time on the home page.
■
It sets any new or unread messages for the user in appropriate places in
the appropriate order.
■
It parses or renders the page information and shows the page accord-

ingly to the user.
Other methods for this application include those described in the following
table:
Method Description
authorize() Authorizes everyone on the intranet to view the page and,
therefore, always returns
TRUE.
updateMsgTrack() Takes the message ID that has been read by the user and
updates the database accordingly.
getName() Finds and returns the formatted first name of the user retrieved
from the viewer’s username (e-mail address).
popAutoTip() Pops up a tip of the day. It is called from the displayHome()
method if the user has the auto-tip option ON in her preference.
unhtmlentities() The exact reverse of the htmlentities() method in the
PHP API.
Now we will develop a set of mini applications that can be run from the home
page of each user. They are as follows:
◆
MOTDO manager application: This application is used to send intranet
messages from one user to another. It is ideally used by administrators to
notify users of company-wide events, hence it is named the MOTD
(Message of the Day) application.
◆
Access reporter application: This application is used to provide
login/logout reports for intranet users. Each user can view her access log
information in a nicely formatted manner to see how she is keeping her
office hours. Users cannot view other user’s access report.
◆
Admin access reporter application: This application allows intranet
administrators to view anyone’s access report in a daily, weekly, or

monthly view.
◆
Daily logbook application: This application allows users to view the
login/logout activities for a given day.
224 Part II: Developing Intranet Solutions
10 549669 ch07.qxd 4/4/03 9:25 AM Page 224
◆
User preference application: This application allows users to set their
themes and automatic tip-preference settings.
◆
User tip application: This application shows an automatic tip from the tip
directory when a user sets her preference to receive an automatic tip on
each login.
The details of these applications are discussed in the following sections.
MOTD manager application
The MOTD manager application, ln_msg_mngr.php, is responsible for managing
daily messages. It is included on the CD-ROM in the ch07/apps directory.
The application implements the following functionality:
◆
It enables all users to create, modify, and delete messages.
Administrative users use a different message template than regular users
so that admin messages can be easily identified.
◆
It enables all users to select viewers for each message while adding or
modifying messages.
This application has the following methods:
◆
run(): When the application is run, this method is called. It does the
following:
■

Calls the authorize() method to see whether the user is allowed to
access this application. If the user is not allowed, it displays an alert
message and returns her to the home page.
■
Creates a theme object called $this->themeObj and retrieves the theme
selection for the current user by using the getUserTheme() method. The
chosen theme is set to $this->theme variable of the application.
■
Uses two query parameters, cmd and step, to determine which message
operation (add, modify, delete) is requested and what step of the
operation needs to be processed. When cmd is set to add, step can be
null, which represents the start of the add message operation, and,
therefore, displayMsgAddModMenu() is called to show the add message
interface. After the user fills out the new message information, the
interface submits a step parameter with a value of 2, indicating that
the user has submitted a new message. Then confirmMessage() is
called to display a confirmation page showing the message for the user
to confirm. When the user confirms the message, the step parameter is
Chapter 7: Intranet System 225
10 549669 ch07.qxd 4/4/03 9:25 AM Page 225