Thread: [Cppcms-users] query string
Brought to you by:
artyom-beilis
From: mawan s. <ma...@gm...> - 2015-09-30 07:05:43
|
Dear All is there any method from request object to get querystring value? is it similar with value from form (using load content)? Thanks |
From: kpeo <sla...@ya...> - 2015-09-30 07:43:03
|
<div>Hi!<br /><br />You can get raw post data from request (let's assume cppcms::application& app_;) in your application (below).<br />(see: <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html">http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html</a>)<a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html"></a><br /><div><p>But it's not seems like a good practice, because CppCMS have built-in forms/widgets classes - see: <a href="http://cppcms.com/wikipp/en/page/cppcms_1x_forms">http://cppcms.com/wikipp/en/page/cppcms_1x_forms</a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms"><br /></a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms">http://cppcms.com/wikipp/en/page/ref_cppcms_forms<br /></a></p></div><div>AFAIK values are the same, but by using CppCMS classes you have additional compile-time type checking, usefull functional, etc.<br /><br />virtual void post(content::my_content& c)</div><p>{<br /> cppcms::http::request& req = app_.request();<br /> if (req.request_method()=="POST") {<br /> std::pair<void *,size_t> post_data = req.raw_post_data();<br /> std::istringstream ss(std::string(reinterpret_cast<char const *>(post_data.first),post_data.second));<br /> //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str();<br /><br />// Get some submitted values</p><p> if(!req.post("check").empty()) //get some hidden input value for form with name "check"<br /> {<br /> std::string name = req.post("name"); //get value of input with name "name"</p><p>// Some handler</p><p> }<br />}<br /><br /></p><p>Best regards,<br />kpeo</p></div><div>30.09.2015, 10:06, "mawan sugiyanto" <ma...@gm...>:</div><blockquote type="cite"><div>Dear All <div> </div><div>is there any method from request object to get querystring value?</div><div>is it similar with value from form (using load content)?</div><div> </div><div>Thanks</div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote> |
From: mawan s. <ma...@gm...> - 2015-09-30 07:54:56
|
How good practice about to get paramters from query string (GET method , and not from POST method)? Thanks On Wed, Sep 30, 2015 at 2:42 PM, kpeo <sla...@ya...> wrote: > Hi! > > You can get raw post data from request (let's assume cppcms::application& > app_;) in your application (below). > (see: > http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html) > <http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html> > > But it's not seems like a good practice, because CppCMS have built-in > forms/widgets classes - see: > http://cppcms.com/wikipp/en/page/cppcms_1x_forms > <http://cppcms.com/wikipp/en/page/ref_cppcms_forms> > http://cppcms.com/wikipp/en/page/ref_cppcms_forms > AFAIK values are the same, but by using CppCMS classes you have additional > compile-time type checking, usefull functional, etc. > > virtual void post(content::my_content& c) > > { > cppcms::http::request& req = app_.request(); > if (req.request_method()=="POST") { > std::pair<void *,size_t> post_data = req.raw_post_data(); > std::istringstream ss(std::string(reinterpret_cast<char const > *>(post_data.first),post_data.second)); > //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str(); > > // Get some submitted values > > if(!req.post("check").empty()) //get some hidden input value for form > with name "check" > { > std::string name = req.post("name"); //get value of input with name > "name" > > // Some handler > > } > } > > Best regards, > kpeo > 30.09.2015, 10:06, "mawan sugiyanto" <ma...@gm...>: > > Dear All > > is there any method from request object to get querystring value? > is it similar with value from form (using load content)? > > Thanks > , > > > ------------------------------------------------------------------------------ > , > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > |
From: Artyom B. <art...@ya...> - 2015-09-30 10:35:36
|
No good practice is use widgets - because widgets do much more than "convinient" palceholders - They perform some validation that you even usually don't think of (for example make sure that the text is in valid encoding)- They integrate with CSRF facilities for security And more... I suggest go over tutorials Artyom Beilis From: mawan sugiyanto <ma...@gm...> To: cpp...@li... Sent: Wednesday, September 30, 2015 10:54 AM Subject: Re: [Cppcms-users] query string How good practice about to get paramters from query string (GET method , and not from POST method)? Thanks On Wed, Sep 30, 2015 at 2:42 PM, kpeo <sla...@ya...> wrote: Hi! You can get raw post data from request (let's assume cppcms::application& app_;) in your application (below). (see: http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html) But it's not seems like a good practice, because CppCMS have built-in forms/widgets classes - see: http://cppcms.com/wikipp/en/page/cppcms_1x_forms http://cppcms.com/wikipp/en/page/ref_cppcms_forms AFAIK values are the same, but by using CppCMS classes you have additional compile-time type checking, usefull functional, etc. virtual void post(content::my_content& c){ cppcms::http::request& req = app_.request(); if (req.request_method()=="POST") { std::pair<void *,size_t> post_data = req.raw_post_data(); std::istringstream ss(std::string(reinterpret_cast<char const *>(post_data.first),post_data.second)); //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str(); // Get some submitted values if(!req.post("check").empty()) //get some hidden input value for form with name "check" { std::string name = req.post("name"); //get value of input with name "name"// Some handler } } Best regards, kpeo30.09.2015, 10:06, "mawan sugiyanto" <ma...@gm...>: Dear All is there any method from request object to get querystring value?is it similar with value from form (using load content)? Thanks,------------------------------------------------------------------------------,_______________________________________________ Cppcms-users mailing list Cpp...@li... https://lists.sourceforge.net/lists/listinfo/cppcms-users ------------------------------------------------------------------------------ _______________________________________________ Cppcms-users mailing list Cpp...@li... https://lists.sourceforge.net/lists/listinfo/cppcms-users ------------------------------------------------------------------------------ _______________________________________________ Cppcms-users mailing list Cpp...@li... https://lists.sourceforge.net/lists/listinfo/cppcms-users |
From: kpeo <sla...@ya...> - 2015-09-30 08:24:11
|
<div><span><span>You can use req.get("name") instead req.post("name") and "</span></span>if (req.request_method()=="GET") {"<br /><span><span><span><br />There is no </span></span></span>raw_post_data() member in request class, but you can use <br /><a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#af80022c2dddaf68330eb7f3f23ec84fc">form_type</a> const& <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90">cppcms::http::request::post_or_get</a>()<br /><span>(form_type represents form-data key-value pairs)<br /></span>See: <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90">http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90</a><br /><span><br />Best regards,<br />kpeo<br /><br />And also it's good point to read this article: <a href="http://cppcms.com/wikipp/en/page/secure_programming">http://cppcms.com/wikipp/en/page/secure_programming<br /></a></span></div><div> </div><div>30.09.2015, 10:55, "mawan sugiyanto" <ma...@gm...>:</div><blockquote type="cite"><div>How good practice about to get paramters from query string (GET method , and not from POST method)?<div> </div><div>Thanks </div></div><div><br /><div>On Wed, Sep 30, 2015 at 2:42 PM, kpeo <span><<a href="mailto:sla...@ya..." target="_blank">sla...@ya...</a>></span> wrote:<br /><blockquote style="margin:0 0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex;"><div>Hi!<br /><br />You can get raw post data from request (let's assume cppcms::application& app_;) in your application (below).<br />(see: <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html" target="_blank">http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html</a>)<a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html" target="_blank"></a><br /><div><p>But it's not seems like a good practice, because CppCMS have built-in forms/widgets classes - see: <a href="http://cppcms.com/wikipp/en/page/cppcms_1x_forms" target="_blank">http://cppcms.com/wikipp/en/page/cppcms_1x_forms</a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms" target="_blank"><br /></a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms" target="_blank">http://cppcms.com/wikipp/en/page/ref_cppcms_forms<br /></a></p></div><div>AFAIK values are the same, but by using CppCMS classes you have additional compile-time type checking, usefull functional, etc.<br /><br />virtual void post(content::my_content& c)</div><p>{<br /> cppcms::http::request& req = app_.request();<br /> if (req.request_method()=="POST") {<br /> std::pair<void *,size_t> post_data = req.raw_post_data();<br /> std::istringstream ss(std::string(reinterpret_cast<char const *>(post_data.first),post_data.second));<br /> //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str();<br /><br />// Get some submitted values</p><p> if(!req.post("check").empty()) //get some hidden input value for form with name "check"<br /> {<br /> std::string name = req.post("name"); //get value of input with name "name"</p><p>// Some handler</p><p> }<br />}<br /><br /></p><p>Best regards,<br />kpeo</p></div><div>30.09.2015, 10:06, "mawan sugiyanto" <<a href="mailto:ma...@gm..." target="_blank">ma...@gm...</a>>:</div><blockquote type="cite"><div><div><div>Dear All <div> </div><div>is there any method from request object to get querystring value?</div><div>is it similar with value from form (using load content)?</div><div> </div><div>Thanks</div></div></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li..." target="_blank">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote><br />------------------------------------------------------------------------------<br /> <br />_______________________________________________<br /> Cppcms-users mailing list<br /> <a href="mailto:Cpp...@li...">Cpp...@li...</a><br /> <a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a><br /> </blockquote></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote> |
From: mawan s. <ma...@gm...> - 2015-09-30 08:30:20
|
Thanks Kpeo So, is there no load for context if i use GET method? The next, some time I use identifier / name of field using query string &data[x][name]=value Is it convert to array like PHP post method, or we must loop manually using request().get("data[x][name]")? Thank you On Wed, Sep 30, 2015 at 3:23 PM, kpeo <sla...@ya...> wrote: > You can use req.get("name") instead req.post("name") and "if > (req.request_method()=="GET") {" > > There is no raw_post_data() member in request class, but you can use > form_type > <http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#af80022c2dddaf68330eb7f3f23ec84fc> > const& cppcms::http::request::post_or_get > <http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90> > () > (form_type represents form-data key-value pairs) > See: > http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90 > > Best regards, > kpeo > > And also it's good point to read this article: > http://cppcms.com/wikipp/en/page/secure_programming > > 30.09.2015, 10:55, "mawan sugiyanto" <ma...@gm...>: > > How good practice about to get paramters from query string (GET method , > and not from POST method)? > > Thanks > > On Wed, Sep 30, 2015 at 2:42 PM, kpeo <sla...@ya...> wrote: > > Hi! > > You can get raw post data from request (let's assume cppcms::application& > app_;) in your application (below). > (see: > http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html) > <http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html> > > But it's not seems like a good practice, because CppCMS have built-in > forms/widgets classes - see: > http://cppcms.com/wikipp/en/page/cppcms_1x_forms > <http://cppcms.com/wikipp/en/page/ref_cppcms_forms> > http://cppcms.com/wikipp/en/page/ref_cppcms_forms > AFAIK values are the same, but by using CppCMS classes you have additional > compile-time type checking, usefull functional, etc. > > virtual void post(content::my_content& c) > > { > cppcms::http::request& req = app_.request(); > if (req.request_method()=="POST") { > std::pair<void *,size_t> post_data = req.raw_post_data(); > std::istringstream ss(std::string(reinterpret_cast<char const > *>(post_data.first),post_data.second)); > //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str(); > > // Get some submitted values > > if(!req.post("check").empty()) //get some hidden input value for form > with name "check" > { > std::string name = req.post("name"); //get value of input with name > "name" > > // Some handler > > } > } > > Best regards, > kpeo > 30.09.2015, 10:06, "mawan sugiyanto" <ma...@gm...>: > > Dear All > > is there any method from request object to get querystring value? > is it similar with value from form (using load content)? > > Thanks > , > > > ------------------------------------------------------------------------------ > , > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > , > > > ------------------------------------------------------------------------------ > , > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > |
From: kpeo <sla...@ya...> - 2015-09-30 09:07:10
|
<div>P.S. And you can see - for request::get(std::string const &name) - the code is same.</div><div> </div><div>30.09.2015, 11:31, "mawan sugiyanto" <ma...@gm...>:</div><blockquote type="cite"><div>Thanks Kpeo <div> </div><div>So, is there no load for context if i use GET method?</div><div> </div><div>The next, some time I use identifier / name of field using query string &data[x][name]=value</div><div> </div><div>Is it convert to array like PHP post method, or we must loop manually using request().get("data[x][name]")?</div><div> </div><div>Thank you </div><div> </div><div> </div></div><div><br /><div>On Wed, Sep 30, 2015 at 3:23 PM, kpeo <span><<a href="mailto:sla...@ya..." target="_blank">sla...@ya...</a>></span> wrote:<br /><blockquote style="margin:0 0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><span><span>You can use req.get("name") instead req.post("name") and "</span></span>if (req.request_method()=="GET") {"<br /><span><span><span><br />There is no </span></span></span>raw_post_data() member in request class, but you can use <br /><a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#af80022c2dddaf68330eb7f3f23ec84fc" target="_blank">form_type</a> const& <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90" target="_blank">cppcms::http::request::post_or_get</a>()<br /><span>(form_type represents form-data key-value pairs)<br /></span>See: <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90" target="_blank">http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90</a><br /><span><br />Best regards,<br />kpeo<br /><br />And also it's good point to read this article: <a href="http://cppcms.com/wikipp/en/page/secure_programming" target="_blank">http://cppcms.com/wikipp/en/page/secure_programming<br /></a></span></div><div> </div><div>30.09.2015, 10:55, "mawan sugiyanto" <<a href="mailto:ma...@gm..." target="_blank">ma...@gm...</a>>:</div><div><div><blockquote type="cite"><div>How good practice about to get paramters from query string (GET method , and not from POST method)?<div> </div><div>Thanks </div></div><div><br /><div>On Wed, Sep 30, 2015 at 2:42 PM, kpeo <span><<a href="mailto:sla...@ya..." target="_blank">sla...@ya...</a>></span> wrote:<br /><blockquote style="margin:0 0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex;"><div>Hi!<br /><br />You can get raw post data from request (let's assume cppcms::application& app_;) in your application (below).<br />(see: <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html" target="_blank">http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html</a>)<a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html" target="_blank"></a><br /><div><p>But it's not seems like a good practice, because CppCMS have built-in forms/widgets classes - see: <a href="http://cppcms.com/wikipp/en/page/cppcms_1x_forms" target="_blank">http://cppcms.com/wikipp/en/page/cppcms_1x_forms</a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms" target="_blank"><br /></a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms" target="_blank">http://cppcms.com/wikipp/en/page/ref_cppcms_forms<br /></a></p></div><div>AFAIK values are the same, but by using CppCMS classes you have additional compile-time type checking, usefull functional, etc.<br /><br />virtual void post(content::my_content& c)</div><p>{<br /> cppcms::http::request& req = app_.request();<br /> if (req.request_method()=="POST") {<br /> std::pair<void *,size_t> post_data = req.raw_post_data();<br /> std::istringstream ss(std::string(reinterpret_cast<char const *>(post_data.first),post_data.second));<br /> //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str();<br /><br />// Get some submitted values</p><p> if(!req.post("check").empty()) //get some hidden input value for form with name "check"<br /> {<br /> std::string name = req.post("name"); //get value of input with name "name"</p><p>// Some handler</p><p> }<br />}<br /><br /></p><p>Best regards,<br />kpeo</p></div><div>30.09.2015, 10:06, "mawan sugiyanto" <<a href="mailto:ma...@gm..." target="_blank">ma...@gm...</a>>:</div><blockquote type="cite"><div><div><div>Dear All <div> </div><div>is there any method from request object to get querystring value?</div><div>is it similar with value from form (using load content)?</div><div> </div><div>Thanks</div></div></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li..." target="_blank">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote><br />------------------------------------------------------------------------------<br /> <br />_______________________________________________<br /> Cppcms-users mailing list<br /> <a href="mailto:Cpp...@li..." target="_blank">Cpp...@li...</a><br /> <a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></blockquote></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li..." target="_blank">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote></div></div><br />------------------------------------------------------------------------------<br /> <br />_______________________________________________<br /> Cppcms-users mailing list<br /> <a href="mailto:Cpp...@li...">Cpp...@li...</a><br /> <a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a><br /> </blockquote></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote> |
From: Joerg S. <jo...@br...> - 2015-10-01 13:42:35
|
On Wed, Sep 30, 2015 at 03:29:34PM +0700, mawan sugiyanto wrote: > Thanks Kpeo > > So, is there no load for context if i use GET method? What do you mean here? What "context"? Using either GET or POST depending on the method for a parameter is bad design, but something various web frameworks have made popular. > The next, some time I use identifier / name of field using query string > &data[x][name]=value > > Is it convert to array like PHP post method, or we must loop manually using > request().get("data[x][name]")? There is no generic mechanism for multi-level arrays because that's not a construct by either form of requests. I have no idea what PHP is doing, some name mangling internally? Joerg |
From: kpeo <sla...@ya...> - 2015-09-30 09:02:32
|
<div><blockquote type="cite">So, is there no load for context if i use GET method?</blockquote><p>GET is tiny bit "harder" to get because of parse from QUERY_STRING.<br />And GET is less secure than POST, because it exposes the information via the URL.</p><blockquote type="cite"><div>The next, some time I use identifier / name of field using query string &data[x][name]=value</div><div> </div><div>Is it convert to array like PHP post method, or we must loop manually using request().get("data[x][name]")?</div></blockquote><p>It's clear from the source http_request.cpp/h:</p><p>form_type post_;<br /><br />std::string request::post(std::string const &name)<br />{<br /> std::pair<form_type::iterator,form_type::iterator> pair = post_.equal_range(name);<br /> form_type::iterator p = pair.first;<br /> if(pair.first == pair.second || ++pair.first != pair.second)<br /> return std::string();<br /> return p->second;<br />}</p><p>request::form_type const &request::post()<br />{<br /> return post_;<br />}<br /><br />Best regards,<br />kpeo</p><p>30.09.2015, 11:31, "mawan sugiyanto" <ma...@gm...>:</p></div><blockquote type="cite"><div>Thanks Kpeo <div> </div><div>So, is there no load for context if i use GET method?</div><div> </div><div>The next, some time I use identifier / name of field using query string &data[x][name]=value</div><div> </div><div>Is it convert to array like PHP post method, or we must loop manually using request().get("data[x][name]")?</div><div> </div><div>Thank you </div><div> </div><div> </div></div><div><br /><div>On Wed, Sep 30, 2015 at 3:23 PM, kpeo <span><<a href="mailto:sla...@ya..." target="_blank">sla...@ya...</a>></span> wrote:<br /><blockquote style="margin:0 0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex;"><div><span><span>You can use req.get("name") instead req.post("name") and "</span></span>if (req.request_method()=="GET") {"<br /><span><span><span><br />There is no </span></span></span>raw_post_data() member in request class, but you can use <br /><a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#af80022c2dddaf68330eb7f3f23ec84fc" target="_blank">form_type</a> const& <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90" target="_blank">cppcms::http::request::post_or_get</a>()<br /><span>(form_type represents form-data key-value pairs)<br /></span>See: <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90" target="_blank">http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90</a><br /><span><br />Best regards,<br />kpeo<br /><br />And also it's good point to read this article: <a href="http://cppcms.com/wikipp/en/page/secure_programming" target="_blank">http://cppcms.com/wikipp/en/page/secure_programming<br /></a></span></div><div> </div><div>30.09.2015, 10:55, "mawan sugiyanto" <<a href="mailto:ma...@gm..." target="_blank">ma...@gm...</a>>:</div><div><div><blockquote type="cite"><div>How good practice about to get paramters from query string (GET method , and not from POST method)?<div> </div><div>Thanks </div></div><div><br /><div>On Wed, Sep 30, 2015 at 2:42 PM, kpeo <span><<a href="mailto:sla...@ya..." target="_blank">sla...@ya...</a>></span> wrote:<br /><blockquote style="margin:0 0 0 0.8ex;border-left:1px #ccc solid;padding-left:1ex;"><div>Hi!<br /><br />You can get raw post data from request (let's assume cppcms::application& app_;) in your application (below).<br />(see: <a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html" target="_blank">http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html</a>)<a href="http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html" target="_blank"></a><br /><div><p>But it's not seems like a good practice, because CppCMS have built-in forms/widgets classes - see: <a href="http://cppcms.com/wikipp/en/page/cppcms_1x_forms" target="_blank">http://cppcms.com/wikipp/en/page/cppcms_1x_forms</a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms" target="_blank"><br /></a><a href="http://cppcms.com/wikipp/en/page/ref_cppcms_forms" target="_blank">http://cppcms.com/wikipp/en/page/ref_cppcms_forms<br /></a></p></div><div>AFAIK values are the same, but by using CppCMS classes you have additional compile-time type checking, usefull functional, etc.<br /><br />virtual void post(content::my_content& c)</div><p>{<br /> cppcms::http::request& req = app_.request();<br /> if (req.request_method()=="POST") {<br /> std::pair<void *,size_t> post_data = req.raw_post_data();<br /> std::istringstream ss(std::string(reinterpret_cast<char const *>(post_data.first),post_data.second));<br /> //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str();<br /><br />// Get some submitted values</p><p> if(!req.post("check").empty()) //get some hidden input value for form with name "check"<br /> {<br /> std::string name = req.post("name"); //get value of input with name "name"</p><p>// Some handler</p><p> }<br />}<br /><br /></p><p>Best regards,<br />kpeo</p></div><div>30.09.2015, 10:06, "mawan sugiyanto" <<a href="mailto:ma...@gm..." target="_blank">ma...@gm...</a>>:</div><blockquote type="cite"><div><div><div>Dear All <div> </div><div>is there any method from request object to get querystring value?</div><div>is it similar with value from form (using load content)?</div><div> </div><div>Thanks</div></div></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li..." target="_blank">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote><br />------------------------------------------------------------------------------<br /> <br />_______________________________________________<br /> Cppcms-users mailing list<br /> <a href="mailto:Cpp...@li..." target="_blank">Cpp...@li...</a><br /> <a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></blockquote></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li..." target="_blank">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote></div></div><br />------------------------------------------------------------------------------<br /> <br />_______________________________________________<br /> Cppcms-users mailing list<br /> <a href="mailto:Cpp...@li...">Cpp...@li...</a><br /> <a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a><br /> </blockquote></div></div>,<p>------------------------------------------------------------------------------</p>,<p>_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote> |
From: mawan s. <ma...@gm...> - 2015-09-30 09:10:02
|
Thankyou , i will read more detial about the source code. Best Regards. Mawan On Wed, Sep 30, 2015 at 4:02 PM, kpeo <sla...@ya...> wrote: > So, is there no load for context if i use GET method? > > GET is tiny bit "harder" to get because of parse from QUERY_STRING. > And GET is less secure than POST, because it exposes the information via > the URL. > > The next, some time I use identifier / name of field using query string > &data[x][name]=value > > Is it convert to array like PHP post method, or we must loop manually > using request().get("data[x][name]")? > > It's clear from the source http_request.cpp/h: > > form_type post_; > > std::string request::post(std::string const &name) > { > std::pair<form_type::iterator,form_type::iterator> pair = > post_.equal_range(name); > form_type::iterator p = pair.first; > if(pair.first == pair.second || ++pair.first != pair.second) > return std::string(); > return p->second; > } > > request::form_type const &request::post() > { > return post_; > } > > Best regards, > kpeo > > 30.09.2015, 11:31, "mawan sugiyanto" <ma...@gm...>: > > Thanks Kpeo > > So, is there no load for context if i use GET method? > > The next, some time I use identifier / name of field using query string > &data[x][name]=value > > Is it convert to array like PHP post method, or we must loop manually > using request().get("data[x][name]")? > > Thank you > > > > On Wed, Sep 30, 2015 at 3:23 PM, kpeo <sla...@ya...> wrote: > > You can use req.get("name") instead req.post("name") and "if > (req.request_method()=="GET") {" > > There is no raw_post_data() member in request class, but you can use > form_type > <http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#af80022c2dddaf68330eb7f3f23ec84fc> > const& cppcms::http::request::post_or_get > <http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90> > () > (form_type represents form-data key-value pairs) > See: > http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html#a0d9ff833540a1a78c5f290aec99cdd90 > > Best regards, > kpeo > > And also it's good point to read this article: > http://cppcms.com/wikipp/en/page/secure_programming > > 30.09.2015, 10:55, "mawan sugiyanto" <ma...@gm...>: > > How good practice about to get paramters from query string (GET method , > and not from POST method)? > > Thanks > > On Wed, Sep 30, 2015 at 2:42 PM, kpeo <sla...@ya...> wrote: > > Hi! > > You can get raw post data from request (let's assume cppcms::application& > app_;) in your application (below). > (see: > http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html) > <http://cppcms.com/cppcms_ref/latest/classcppcms_1_1http_1_1request.html> > > But it's not seems like a good practice, because CppCMS have built-in > forms/widgets classes - see: > http://cppcms.com/wikipp/en/page/cppcms_1x_forms > <http://cppcms.com/wikipp/en/page/ref_cppcms_forms> > http://cppcms.com/wikipp/en/page/ref_cppcms_forms > AFAIK values are the same, but by using CppCMS classes you have additional > compile-time type checking, usefull functional, etc. > > virtual void post(content::my_content& c) > > { > cppcms::http::request& req = app_.request(); > if (req.request_method()=="POST") { > std::pair<void *,size_t> post_data = req.raw_post_data(); > std::istringstream ss(std::string(reinterpret_cast<char const > *>(post_data.first),post_data.second)); > //BOOSTER_LOG(debug,__FUNCTION__) << "raw post data: " << ss.str(); > > // Get some submitted values > > if(!req.post("check").empty()) //get some hidden input value for form > with name "check" > { > std::string name = req.post("name"); //get value of input with name > "name" > > // Some handler > > } > } > > Best regards, > kpeo > 30.09.2015, 10:06, "mawan sugiyanto" <ma...@gm...>: > > Dear All > > is there any method from request object to get querystring value? > is it similar with value from form (using load content)? > > Thanks > , > > > ------------------------------------------------------------------------------ > , > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > , > > > ------------------------------------------------------------------------------ > , > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > , > > > ------------------------------------------------------------------------------ > , > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > |
From: Joerg S. <jo...@br...> - 2015-09-30 15:23:33
|
On Wed, Sep 30, 2015 at 12:02:21PM +0300, kpeo wrote: > And GET is less secure than POST, because itexposes the information via the > URL. Please don't repeat such nonsense. Both data sets can be easily forged. Correctly written GET request handlers are secure simply because they do not change any state. If they do, they are violating the RFCs badly. > The next, some time I use identifier / name of field using query > string &data[x][name]=value > > Is it convert to array like PHP post method, or we must loop manually > using request().get("data[x][name]")? They is no further deserialization going on, think of it as a string to string map. If you need something more complex, it is often easiest to hook up the JSON parser. Joerg |
From: kpeo <sla...@ya...> - 2015-09-30 15:48:56
|
<div>At my point security - is not about the data transferred between the client and server only.<br />Browser can store the url with requested data in history / cache. Or URL can be stored in clipboard, etc.<br /><span lang="en"><span>These data</span> <span>may not contain</span> <span>confidential data, but may contain some personal information. So GET increases the risks.<br /><span lang="en"></span></span></span></div><div><br />Best regards,<br />kpeo<br /><br />30.09.2015, 18:24, "Joerg Sonnenberger" <jo...@br...>:</div><blockquote type="cite"><p>On Wed, Sep 30, 2015 at 12:02:21PM +0300, kpeo wrote:</p><blockquote> And GET is less secure than POST, because itšexposes the information via the<br /> URL.</blockquote><p><br />Please don't repeat such nonsense. Both data sets can be easily forged.<br />Correctly written GET request handlers are secure simply because they do<br />not change any state. If they do, they are violating the RFCs badly.<br /><br /><br /></p><blockquote> The next, some time I use identifier / name of field using query<br /> string &amp;data[x][name]=value<br /> š<br /> Is it convert to array like PHP post method, or we must loop manually<br /> using request().get("data[x][name]")?</blockquote><p><br />They is no further deserialization going on, think of it as a string to<br />string map. If you need something more complex, it is often easiest to<br />hook up the JSON parser.<br /><br />Joerg<br /><br />------------------------------------------------------------------------------<br />_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote> |
From: Joerg S. <jo...@br...> - 2015-09-30 16:44:04
|
On Wed, Sep 30, 2015 at 06:48:44PM +0300, kpeo wrote: > At my point security - is not about the data transferred between the client and > server only. > Browser can store the url with requested data in history / cache. Or URL can be > stored in clipboard, etc. > These data may not contain confidential data, but may contain some personal > information. So GET increases the risks. Yes, there are specific cases where a POST is useful for idempotent operations. Most of them disappeared with AJAX. Secure tips like "POST is more secure than GET" are the reason why we still have so many extremely bad behaving applications: (1) Using POST because it isn't cached instead of proper cache control. (2) Using POST because it doesn't make things appear in the (client) history. (3) Using POST to prevent C&P. None of this is about security. It is all a form of obscurity at best. The first criterion for GET vs POST should *always* be: does the request change any state? If the request is issued a second time, does something break? If the answer is no, it should *normally* be a GET. There are a few exceptions: (1) You want to pass a lot of data. In the past, some servers liked to complain about passing 200 characters by query string. (2) You have a sensitive query parameter and can't do the query indirectly via AJAX OR can't trust your deployment to have a sane logging configuration. That's about what I can think of after travelling for 12h. If you look at it carefully, the second point doesn't really fix the problem in any way. If you want to pass sensitive data around, encrypt it. Not just the transport, but the individual item as well. Remember, no storing of unencrypted credit card data as example. It's quite a good policy to do that as early as possible. I'm annoyed by such blanket statements, because they almost always lead to bad design decisions upfront by people that don't completely understand the ramnifications. Look at all the web shops still around where you can't just hit the Back button of your browser without getting annoying warnings about having to resubmit form data, even if you are just browsing the catalog. Joerg |
From: kpeo <sla...@ya...> - 2015-09-30 20:30:54
|
<div>Agree. My cursory answer on GET's question may be misentrpreted, lead to misunderstanding of web-design concepts, incorrect conclusions and wrong design desicions. Sure, the choice of POST/GET/Ajax should be thoughtful, careful and depends on the current task, environment, compatibility, other factors. In most cases your scenario is correct. BTW, it could seems like Ajax solves all the problems, but its usage has also both advantages and disadvantages for the specific case.<br /><br />Thank you.<br /><br />Best regards,<br />kpeo<br /><br /></div><div>30.09.2015, 19:44, "Joerg Sonnenberger" <jo...@br...>:</div><blockquote type="cite"><p>On Wed, Sep 30, 2015 at 06:48:44PM +0300, kpeo wrote:</p><blockquote> At my point security - is not about the data transferred between the client and<br /> server only.<br /> Browser can store the url with requested data in history / cache. Or URL can be<br /> stored in clipboard, etc.<br /> These data may not contain confidential data, but may contain some personal<br /> information. So GET increases the risks.</blockquote><p><br />Yes, there are specific cases where a POST is useful for idempotent<br />operations. Most of them disappeared with AJAX. Secure tips like "POST<br />is more secure than GET" are the reason why we still have so many<br />extremely bad behaving applications:<br />(1) Using POST because it isn't cached instead of proper cache control.<br />(2) Using POST because it doesn't make things appear in the (client)<br />history.<br />(3) Using POST to prevent C&P.<br /><br />None of this is about security. It is all a form of obscurity at best.<br /><br />The first criterion for GET vs POST should *always* be: does the request<br />change any state? If the request is issued a second time, does something<br />break? If the answer is no, it should *normally* be a GET. There are a<br />few exceptions:<br /><br />(1) You want to pass a lot of data. In the past, some servers liked to<br />complain about passing 200 characters by query string.<br /><br />(2) You have a sensitive query parameter and can't do the query<br />indirectly via AJAX OR can't trust your deployment to have a sane<br />logging configuration.<br /><br />That's about what I can think of after travelling for 12h. If you look<br />at it carefully, the second point doesn't really fix the problem in any<br />way. If you want to pass sensitive data around, encrypt it. Not just the<br />transport, but the individual item as well. Remember, no storing of<br />unencrypted credit card data as example. It's quite a good policy to do<br />that as early as possible.<br /><br />I'm annoyed by such blanket statements, because they almost always lead<br />to bad design decisions upfront by people that don't completely<br />understand the ramnifications. Look at all the web shops still around<br />where you can't just hit the Back button of your browser without getting<br />annoying warnings about having to resubmit form data, even if you are<br />just browsing the catalog.<br /><br />Joerg<br /><br />------------------------------------------------------------------------------<br />_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote> |
From: kpeo <sla...@ya...> - 2015-09-30 21:00:25
|
<div>Note: "<span>POST/GET/Ajax</span>" - can confuse, because Ajax is not an independent technology, but environment uses POST/GET. But it one of choices in webdev.</div><div> </div><div>30.09.2015, 19:44, "Joerg Sonnenberger" <jo...@br...>:</div><blockquote type="cite"><p>On Wed, Sep 30, 2015 at 06:48:44PM +0300, kpeo wrote:</p><blockquote> At my point security - is not about the data transferred between the client and<br /> server only.<br /> Browser can store the url with requested data in history / cache. Or URL can be<br /> stored in clipboard, etc.<br /> These data may not contain confidential data, but may contain some personal<br /> information. So GET increases the risks.</blockquote><p><br />Yes, there are specific cases where a POST is useful for idempotent<br />operations. Most of them disappeared with AJAX. Secure tips like "POST<br />is more secure than GET" are the reason why we still have so many<br />extremely bad behaving applications:<br />(1) Using POST because it isn't cached instead of proper cache control.<br />(2) Using POST because it doesn't make things appear in the (client)<br />history.<br />(3) Using POST to prevent C&P.<br /><br />None of this is about security. It is all a form of obscurity at best.<br /><br />The first criterion for GET vs POST should *always* be: does the request<br />change any state? If the request is issued a second time, does something<br />break? If the answer is no, it should *normally* be a GET. There are a<br />few exceptions:<br /><br />(1) You want to pass a lot of data. In the past, some servers liked to<br />complain about passing 200 characters by query string.<br /><br />(2) You have a sensitive query parameter and can't do the query<br />indirectly via AJAX OR can't trust your deployment to have a sane<br />logging configuration.<br /><br />That's about what I can think of after travelling for 12h. If you look<br />at it carefully, the second point doesn't really fix the problem in any<br />way. If you want to pass sensitive data around, encrypt it. Not just the<br />transport, but the individual item as well. Remember, no storing of<br />unencrypted credit card data as example. It's quite a good policy to do<br />that as early as possible.<br /><br />I'm annoyed by such blanket statements, because they almost always lead<br />to bad design decisions upfront by people that don't completely<br />understand the ramnifications. Look at all the web shops still around<br />where you can't just hit the Back button of your browser without getting<br />annoying warnings about having to resubmit form data, even if you are<br />just browsing the catalog.<br /><br />Joerg<br /><br />------------------------------------------------------------------------------<br />_______________________________________________<br />Cppcms-users mailing list<br /><a href="mailto:Cpp...@li...">Cpp...@li...</a><br /><a href="https://lists.sourceforge.net/lists/listinfo/cppcms-users">https://lists.sourceforge.net/lists/listinfo/cppcms-users</a></p></blockquote> |
From: mawan s. <ma...@gm...> - 2015-10-01 13:24:06
|
I think it is no.problem about GET or POST, but why GET method can not be captured with load(context)? On Oct 1, 2015 4:00 AM, "kpeo" <sla...@ya...> wrote: > Note: "POST/GET/Ajax" - can confuse, because Ajax is not an independent > technology, but environment uses POST/GET. But it one of choices in webdev. > > 30.09.2015, 19:44, "Joerg Sonnenberger" <jo...@br...>: > > On Wed, Sep 30, 2015 at 06:48:44PM +0300, kpeo wrote: > > At my point security - is not about the data transferred between the > client and > server only. > Browser can store the url with requested data in history / cache. Or URL > can be > stored in clipboard, etc. > These data may not contain confidential data, but may contain some > personal > information. So GET increases the risks. > > > Yes, there are specific cases where a POST is useful for idempotent > operations. Most of them disappeared with AJAX. Secure tips like "POST > is more secure than GET" are the reason why we still have so many > extremely bad behaving applications: > (1) Using POST because it isn't cached instead of proper cache control. > (2) Using POST because it doesn't make things appear in the (client) > history. > (3) Using POST to prevent C&P. > > None of this is about security. It is all a form of obscurity at best. > > The first criterion for GET vs POST should *always* be: does the request > change any state? If the request is issued a second time, does something > break? If the answer is no, it should *normally* be a GET. There are a > few exceptions: > > (1) You want to pass a lot of data. In the past, some servers liked to > complain about passing 200 characters by query string. > > (2) You have a sensitive query parameter and can't do the query > indirectly via AJAX OR can't trust your deployment to have a sane > logging configuration. > > That's about what I can think of after travelling for 12h. If you look > at it carefully, the second point doesn't really fix the problem in any > way. If you want to pass sensitive data around, encrypt it. Not just the > transport, but the individual item as well. Remember, no storing of > unencrypted credit card data as example. It's quite a good policy to do > that as early as possible. > > I'm annoyed by such blanket statements, because they almost always lead > to bad design decisions upfront by people that don't completely > understand the ramnifications. Look at all the web shops still around > where you can't just hit the Back button of your browser without getting > annoying warnings about having to resubmit form data, even if you are > just browsing the catalog. > > Joerg > > > ------------------------------------------------------------------------------ > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Cppcms-users mailing list > Cpp...@li... > https://lists.sourceforge.net/lists/listinfo/cppcms-users > > |