From: Leigh S. <le...@le...> - 2009-09-21 21:34:42
|
First off, thanks everyone for a great CalDAV server! Running davical on a non VHOSTed server: To host davical on a cPanel hosted server I found I had to modify davical source to deal with the security restrictions that are in place. Virtual hosting and superuser access are not possible on such a server. This required reorganising the layout of the include files when it is not possible to create the directory /etc/davical. One solution would be to simply place the "inc" directory within "htdocs" so the relative path "inc/always.php" can be loaded. Until I verified that this would be secure with the mail list, I wanted a little more security by placing the inc files outside of the directory that hosts the htdocs (renamed "calendar" in my case). So I created a "davical" directory next to my "calendar" directory holding the htdocs. The include files sit there in "davical/inc" subdirectory and the configuration file davical/servername-conf.php. Since I wanted to simplify the location of all source, I simply copied all the files in awl/inc into davical/ inc. This leaves me with a directory structure as: calendar/caldav.php ... calendar/index.php etc. davical/servername-conf.php davical/inc/*.php The patches to the source are fairly minimal to help locate the configuration file: % diff always.php.in ~/SysDev/davical-0.9.6.2_original/inc/always.php.in 34,36d33 < // set the location of the configuration files. < // $c->config_directory = "/etc/davical"; < $c->config_directory = "../davical"; 39c36 < set_include_path( '../davical/inc'. PATH_SEPARATOR. get_include_path ()); --- > set_include_path( '../inc'. PATH_SEPARATOR. get_include_path()); 68,69c65,66 < if ( @file_exists($c->config_directory."/".$_SERVER['SERVER_NAME']."- conf.php") ) { < include_once($c->config_directory."/".$_SERVER['SERVER_NAME']."- conf.php"); --- > if ( @file_exists("/etc/davical/".$_SERVER['SERVER_NAME']."- conf.php") ) { > include_once("/etc/davical/".$_SERVER['SERVER_NAME']."-conf.php"); 74,75c71,72 < else if ( @file_exists($c->config_directory."/config.php") ) { < include_once($c->config_directory."/config.php"); --- > else if ( @file_exists("/etc/davical/config.php") ) { > include_once("/etc/davical/config.php"); % diff davical_configuration_missing.php ~/SysDev/ davical-0.9.6.2_original/inc/davical_configuration_missing.php 7c7 < <p>There is no configuration file present in <b>$c->config_directory/ $_SERVER[SERVER_NAME]-conf.php</b> so --- > <p>There is no configuration file present in <b>/etc/davical/ $_SERVER[SERVER_NAME]-conf.php</b> so and changing all the require_once("../inc/always.php"); entries to require_once("../davical/inc/always.php"); in htdocs/*.php: caldav.php:require_once("../davical/inc/always.php"); collection.php:require_once("../davical/inc/always.php"); freebusy.php:require_once("../davical/inc/always.php"); help.php:require_once("../davical/inc/always.php"); index.php:include("../davical/inc/always.php"); public.php:require_once("../davical/inc/always.php"); relationship_types.php:require_once("../davical/inc/always.php"); roles.php:require_once("../davical/inc/always.php"); tools.php:require_once("../davical/inc/always.php"); users.php:require_once("../davical/inc/always.php"); usr.php: require_once("../davical/inc/always.php"); This seems to work very well and I have been hosting many calendars for several months on a third party hosted server. May I suggest adding the $c->config_directory entry simplifies the installation of davical and makes it possible to manage on servers without super user access? Also would it be secure to move the "inc" directory (with the files from awl) within htdocs, so that it is easier to install the PHP files into a single directory tree, rather than two source directories which must sit next to each other? The patches above would still be required to find the configuration file, unless that would still be secure to be live inside a "htdocs/config" directory? This is actually the strategy used by drupal, for example. Dependencies: While DAViCal is a great program, there seems to be many dependencies to get it running. Since DAViCal states on the web page that there are few dependencies, I'd like to offer this list of dependencies that I discovered trying to install it in the spirit of attempting to make it easier to install and therefore more widely adopted. This hopefully forms a check list to be whittled down. 1. Requires awl. Could a version of this code be exported into the davical distribution package at the same time as the version number is generated, to make configuration and installation smoother for systems which are administered remotely? Some hosted servers actually deny command line access, so dealing with extracting a single tar file rather than merging the extraction of two files is less work. 2. PostgreSQL database usernames are fixed. On cPanel hosted servers, postgreSQL database and user naming must meet a certain format, for example username_databasename and username_dbuser respectively. For example leighsmi_davical and leighsmi_davicalapp (no underscores are allowed in the username after the unix username. The PostgreSQL databases are created using a web admin application (phpPgAdmin), not using the shell script. 3. Requires a shell for running configuration shell scripts. Since most of these scripts simply execute SQL queries, could this also be done with an install PHP script which are run from a browser? Complex PHP systems like drupal can still be installed and run on servers that don't have command line access. There are some permissions which need to be changed after the initial configuration to prevent anyone running the installation PHP script again, but these permissions can be checked. 4. You need to be super user to create the plsql procedural language. There are two problems with this, you need to be superuser to enable such functions, and this makes the code configuration more specific to PostgreSQL. Hosted servers which allow hosting PHP systems like drupal, joomla etc don't grant superuser access. In my case, I had to beg my sysadmin to set the procedural language on my database. It would be great to give the user the option of using MySQL or other DB's. 5. Requires Perl However, other than the initial configuration, this isn't required for normal running of the system. Could this be replaced with PHP scripts? 6. Requires Perl DBD::Pg and DBD::YAML Most systems should have these, but on the cPanel server I was working with, it doesn't come installed (for security), requiring begging the sysadmin to install it for you. So it's easier if this was done in PHP. -- Leigh M. Smith mailto:le...@le... http://www.leighsmith.com |