Thread: [phpesp-dev] Re: phpESP-devel digest, Vol 1 #25 - 8 msgs

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

where is that: Patch for Auto-publishing ??

very intresting! i build up my own script for that but i have secure holes
because i needed to disable some things in handler prefix!

----- Original Message -----
From: <php...@li...>
To: <php...@li...>
Sent: Tuesday, April 16, 2002 9:53 PM
Subject: phpESP-devel digest, Vol 1 #25 - 8 msgs

Send phpESP-devel mailing list submissions to
php...@li...

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.sourceforge.net/lists/listinfo/phpesp-devel
or, via email, send a message with subject or body 'help' to
php...@li...

You can reach the person managing the list at
php...@li...

When replying, please edit your Subject line so it is more specific
than "Re: Contents of phpESP-devel digest..."

Today's Topics:

   1. Re: Patch for Auto-publishing (Kon Angelopoulos)
   2. Re: Patch for Auto-publishing (James E. Flemer)
   3. french translaton (James E. Flemer)
   4. Re: Patch for Auto-publishing (Matthew Gregg)
   5. Re: Patch for Auto-publishing (James E. Flemer)
   6. Re: Patch for Auto-publishing (Matthew Gregg)
   7. Re: Patch for Auto-publishing (Matthew Gregg)
   8. Re: Patch for Auto-publishing (James E. Flemer)

--__--__--

Message: 1
From: Kon Angelopoulos <ang...@ip...>
To: "James E. Flemer" <jf...@ac...>,
 Matthew Gregg <gr...@mu...>
Subject: Re: [phpesp-dev] Patch for Auto-publishing
Date: Tue, 16 Apr 2002 19:49:23 +1000
Cc: <php...@li...>
Organization: angek Productions

Hi Guys,

Just downloaded the latest version to have a look at Matthews patch and was
looking at the code for handler.php

     75         $action = $HTTP_SERVER_VARS['PHP_SELF'];
     76         if (!empty($HTTP_SERVER_VARS['QUERY_STRING']))
     77                 $action .= "?" . $HTTP_SERVER_VARS['QUERY_STRING'];

should line 77 read $action = "?" .$HTTP_SERVER_VARS['QUERY_STRING'];
instead?

otherwise couldn't we  have the following scenario when, for example we test
surveys?

..../.../manage.php?where=test&sid=xx - then clicking the submit button
would
generate:
../../manage.php?where=test?where=test&sid=xx

Regards

Kon

On Mon, 15 Apr 2002 05:05, James E. Flemer wrote:
> On Wed, 10 Apr 2002, Matthew Gregg wrote:
> > Attached is first run at a patch to allow publishing of surveys
> > without needing to manually create a php "include" file.
>
> I made a few slight changes, nothing effecting use, and
> committed this patch. Thanks.
>
> > Take a look in handler-prefix.php where the remote user id is found.
> > I commented the QUERY_STRING case because it would grab the
> > query string for survey selection every time.   Can we live without
> > that case?
>
> I changed this so that survey.php removes "name=xxx" from
> the query string, so no mods to handler-prefix were needed.
>
> Thanks for the patch.
>
> -James
>
>
> _______________________________________________
> phpESP-devel mailing list
> php...@li...
> https://lists.sourceforge.net/lists/listinfo/phpesp-devel

--__--__--

Message: 2
Date: Tue, 16 Apr 2002 10:40:17 -0400 (EDT)
From: "James E. Flemer" <jf...@ac...>
Reply-To: "James E. Flemer" <jf...@ac...>
To: <php...@li...>
Subject: Re: [phpesp-dev] Patch for Auto-publishing

Well, I see the problem, but I fixed it in where/test.inc
instead. Now that the handler sanely treats the
QUERY_STRING, I removed the QS mangling code in test.inc,
that made it possible to embed the handler within the
mangagemnt interface. Please checkout the latest revision
of that file and see if your problems go away.

-James

On Tue, 16 Apr 2002, Kon Angelopoulos wrote:

> Hi Guys,
>
> Just downloaded the latest version to have a look at Matthews patch and
was
> looking at the code for handler.php
>
>
>      75         $action = $HTTP_SERVER_VARS['PHP_SELF'];
>      76         if (!empty($HTTP_SERVER_VARS['QUERY_STRING']))
>      77                 $action .= "?" .
$HTTP_SERVER_VARS['QUERY_STRING'];
>
> should line 77 read $action = "?" .$HTTP_SERVER_VARS['QUERY_STRING'];
instead?
>
> otherwise couldn't we  have the following scenario when, for example we
test
> surveys?
>
> ..../.../manage.php?where=test&sid=xx - then clicking the submit button
would
> generate:
> ../../manage.php?where=test?where=test&sid=xx
>
>
> Regards
>
>
> Kon

--__--__--

Message: 3
Date: Tue, 16 Apr 2002 11:00:32 -0400 (EDT)
From: "James E. Flemer" <jf...@ac...>
Reply-To: "James E. Flemer" <jf...@ac...>
To: <php...@li...>
Subject: [phpesp-dev] french translaton

Hey French Translation Team ...
  Did you send me the translated messages.po file? If you
have, I've lost it in my mountain of email. I do have the
translated images though, and will probably get around to
adding code for choosing the right ones pretty soon. (I
have final exams coming up so my time might be limited.)
-James

--__--__--

Message: 4
Date: Tue, 16 Apr 2002 11:07:17 -0400
From: Matthew Gregg <gr...@mu...>
To: "James E. Flemer" <jf...@ac...>
Cc: php...@li...
Subject: Re: [phpesp-dev] Patch for Auto-publishing

The change to remove "name=xxx" from the query string brings up a
small problem.

The first time through a survey the referer is set correctly so that
the "return" link on the "thank you" page works correctly, however, if
you click that link to take the survey again, the "name=xxx" will be
dropped from the referer.  So a second time through the survey the
"return" link fails.

On Sun, Apr 14, 2002 at 03:05:39PM -0400, James E. Flemer wrote:
> On Wed, 10 Apr 2002, Matthew Gregg wrote:
>
> > Attached is first run at a patch to allow publishing of surveys
> > without needing to manually create a php "include" file.
>
> I made a few slight changes, nothing effecting use, and
> committed this patch. Thanks.
>
> > Take a look in handler-prefix.php where the remote user id is found.
> > I commented the QUERY_STRING case because it would grab the
> > query string for survey selection every time.   Can we live without
> > that case?
>
> I changed this so that survey.php removes "name=xxx" from
> the query string, so no mods to handler-prefix were needed.
>
> Thanks for the patch.
>
> -James
>

--
brought to you by, Matthew Gregg...
one of the friendly folks in the IT Lab.
--------------------------------------\
The IT Lab (http://www.itlab.musc.edu) \____________________
Probably the world's premier software development center.
Serving: Programming, Tools, Ice Cream, Seminars

--__--__--

Message: 5
Date: Tue, 16 Apr 2002 11:31:35 -0400 (EDT)
From: "James E. Flemer" <jf...@ac...>
Reply-To: "James E. Flemer" <jf...@ac...>
To: Matthew Gregg <gr...@mu...>
Cc: <php...@li...>
Subject: Re: [phpesp-dev] Patch for Auto-publishing

Well ... Ideally the "return" link is supposed to be to the
page _before_ the survey.

So you've got some index.html somewhere with
  [a href="/survey.php?name=foo"] Take a Survey [/a]
Then the "return" link should take you back to
"index.html".

However if you type http://place.ext/survey.php?name=foo
into the url bar, then there is no referrer, so it sorta
goes back to itself.

What do you all think the policy should be?

Vote:
   http://phpesp.sf.net/demo/test.php?sid=2944&userid=devel
Results:
   http://phpesp.sf.net/demo/test.php?sid=2944&results=1

-James

On Tue, 16 Apr 2002, Matthew Gregg wrote:

> The change to remove "name=xxx" from the query string brings up a
> small problem.
>
> The first time through a survey the referer is set correctly so that
> the "return" link on the "thank you" page works correctly, however, if
> you click that link to take the survey again, the "name=xxx" will be
> dropped from the referer.  So a second time through the survey the
> "return" link fails.

--__--__--

Message: 6
Date: Tue, 16 Apr 2002 11:46:14 -0400
From: Matthew Gregg <gr...@mu...>
To: "James E. Flemer" <jf...@ac...>
Cc: php...@li...
Subject: Re: [phpesp-dev] Patch for Auto-publishing

On Tue, Apr 16, 2002 at 11:31:35AM -0400, James E. Flemer wrote:
> Well ... Ideally the "return" link is supposed to be to the
> page _before_ the survey.
Oh duh, yeah that would make sense.

>
> So you've got some index.html somewhere with
>   [a href="/survey.php?name=foo"] Take a Survey [/a]
> Then the "return" link should take you back to
> "index.html".
>
> However if you type http://place.ext/survey.php?name=foo
> into the url bar, then there is no referrer, so it sorta
> goes back to itself.
>
> What do you all think the policy should be?
>
> Vote:
>    http://phpesp.sf.net/demo/test.php?sid=2944&userid=devel

Vote cast.
> Results:
>    http://phpesp.sf.net/demo/test.php?sid=2944&results=1
>
> -James
>
>
> On Tue, 16 Apr 2002, Matthew Gregg wrote:
>
> > The change to remove "name=xxx" from the query string brings up a
> > small problem.
> >
> > The first time through a survey the referer is set correctly so that
> > the "return" link on the "thank you" page works correctly, however, if
> > you click that link to take the survey again, the "name=xxx" will be
> > dropped from the referer.  So a second time through the survey the
> > "return" link fails.
>

--
brought to you by, Matthew Gregg...
one of the friendly folks in the IT Lab.
--------------------------------------\
The IT Lab (http://www.itlab.musc.edu) \____________________
Probably the world's premier software development center.
Serving: Programming, Tools, Ice Cream, Seminars

--__--__--

Message: 7
Date: Tue, 16 Apr 2002 12:01:55 -0400
From: Matthew Gregg <gr...@mu...>
To: "James E. Flemer" <jf...@ac...>
Cc: php...@li...
Subject: Re: [phpesp-dev] Patch for Auto-publishing

One other thing.
survey.php doesn't take into account private surveys.
I think it's a small change to do this, but larger than I felt safe
committing
to CVS myself :-)

-     $sql = "SELECT id,title FROM survey WHERE name = '$_name'";
+     $sql = "SELECT id, title, public FROM survey WHERE name = '$_name'";
     if ($result = mysql_query($sql)) {
                if (mysql_num_rows($result) > 0)
-                list($sid, $_title) = mysql_fetch_row($result);
+   list($sid, $_title, $public) = mysql_fetch_row($result);
                mysql_free_result($result);
                }
        }
+        if ($public == "N") {
+                include($ESPCONFIG['handler_prefix']);
+        }
?>

On Sun, Apr 14, 2002 at 03:05:39PM -0400, James E. Flemer wrote:
> On Wed, 10 Apr 2002, Matthew Gregg wrote:
>
> > Attached is first run at a patch to allow publishing of surveys
> > without needing to manually create a php "include" file.
>
> I made a few slight changes, nothing effecting use, and
> committed this patch. Thanks.
>
> > Take a look in handler-prefix.php where the remote user id is found.
> > I commented the QUERY_STRING case because it would grab the
> > query string for survey selection every time.   Can we live without
> > that case?
>
> I changed this so that survey.php removes "name=xxx" from
> the query string, so no mods to handler-prefix were needed.
>
> Thanks for the patch.
>
> -James
>

--
brought to you by, Matthew Gregg...
one of the friendly folks in the IT Lab.
--------------------------------------\
The IT Lab (http://www.itlab.musc.edu) \____________________
Probably the world's premier software development center.
Serving: Programming, Tools, Ice Cream, Seminars

--__--__--

Message: 8
Date: Tue, 16 Apr 2002 12:55:44 -0400 (EDT)
From: "James E. Flemer" <jf...@ac...>
Reply-To: "James E. Flemer" <jf...@ac...>
To: Matthew Gregg <gr...@mu...>
Cc: <php...@li...>
Subject: Re: [phpesp-dev] Patch for Auto-publishing

Thanks for pointing that out.
I just committed smaller patch doing the same thing. :-)
There is no need to check public, since the handler prefix
is included by the handler (if it hasn't already) anyway,
so now we just include it explicitly above any content.

     if ($result = mysql_query($sql)) {
                if (mysql_num_rows($result) > 0)
                list($sid, $_title) = mysql_fetch_row($result);
                mysql_free_result($result);
                }
        }
+        include($ESPCONFIG['handler_prefix']);
 ?>

Checkout new revision from cvs.

-James

On Tue, 16 Apr 2002, Matthew Gregg wrote:

> One other thing.
> survey.php doesn't take into account private surveys.
> I think it's a small change to do this, but larger than I felt safe
committing
> to CVS myself :-)
>
> -     $sql = "SELECT id,title FROM survey WHERE name = '$_name'";
> +     $sql = "SELECT id, title, public FROM survey WHERE name = '$_name'";
>      if ($result = mysql_query($sql)) {
>                 if (mysql_num_rows($result) > 0)
> -                list($sid, $_title) = mysql_fetch_row($result);
> +   list($sid, $_title, $public) = mysql_fetch_row($result);
>                 mysql_free_result($result);
>                 }
>         }
> +        if ($public == "N") {
> +                include($ESPCONFIG['handler_prefix']);
> +        }
> ?>

--__--__--

_______________________________________________
phpESP-devel mailing list
php...@li...
https://lists.sourceforge.net/lists/listinfo/phpesp-devel

End of phpESP-devel Digest