Re: [PHPiCalendar-DEV] security suggestions for publish.php

[Jo R. <jr...@ne...>]

I just submitted another fix to publish.php, preventing the writing of 
debug messages to open files, etc.  stupid bug.  I really want to 
rewrite this from scratch :-(

Anyway, any comments on my desire to put publish.php in a ~/publish/ 
directory so that you can control access to the publish function 
separately from access to the calendars themselves?

Jo Rhett wrote:
> Thanks for the primer.  I *finally* did that, and am submitting the 
> changes tonight.  See my later notes.
> 
> Jim Hu wrote:
>> I'm barely competent in it myself, but the key things are:
>>
>> 1. Set up your terminal environment for ssh key generation:
>>
>> For tcsh
>>
>>     setenv CVS_RSH ssh
>>
>> for bash:
>>
>>     export CVS_RSH=ssh
>>
>> 2. Make a key (this step only has to be done the first time you use the 
>> CVS)
>>
>>     ssh-keygen -t dsa -C "USE...@sh..."
>>
>> Then go to your Sourceforge account and add your key to your user 
>> profile.  Wait a bit for the change to propagate through the system
>>
>> 3. To checkout the latest phpicalendar, after cd to the desired directory
>>
>>     cvs -z3 
>> -d:ext:USE...@ph...:/cvsroot/phpicalendar 
>> co -P phpicalendar
>>
>> 4. To save changes in a file
>>
>>     cvs -z3 
>> -d:ext:USE...@ph...:/cvsroot/phpicalendar 
>> commit -m "COMMENT DESCRIBING THE UPDATE."
>>
>> I forget how to add a file; I think it's add to the local copy and then 
>> commit as above.  My usual blunder is to save too many changes to the 
>> local copy before committing.  Also I tend to forget to update the 
>> README to describe bug fixes.  I think that should do it.  If I can do 
>> the CVS, anyone can... I don't even know how to apply patches using diff!
>> =====================================
>> Jim Hu
>> Associate Professor
>> Dept. of Biochemistry and Biophysics
>> 2128 TAMU
>> Texas A&M Univ.
>> College Station, TX 77843-2128
>> 979-862-4054
>>
>>
>> On Sep 17, 2006, at 1:45 PM, Jo Rhett wrote:
>>
>>> On Sun, Sep 17, 2006 at 01:42:54PM -0500, Jim Hu wrote:
>>>> Seems to me that you need to be given CVS access so you can modify
>>>> publish directly.  How does that sound?  Do you have a sourceforge ID
>>>> so I can set you up?
>>> sourceforge ID 'jrhett'
>>>
>>> Sounds fine to me, but I've never dealt with sourceforge CVS and I've 
>>> heard
>>> horror stories about it.  If there's a clue-by-4 guide to dealing with 
>>> it,
>>> let me know.
>>>
>>> --Jo Rhett
>>> senior geek
>>> SVcolo : Silicon Valley Colocation
>>>
>>> -------------------------------------------------------------------------
>>> Using Tomcat but need to do more? Need to support web services, security?
>>> Get stuff done quickly with pre-integrated technology to make your job 
>>> easier
>>> Download IBM WebSphere Application Server v.1.0.1 based on Apache 
>>> Geronimo
>>> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>>> _______________________________________________
>>> Phpicalendar-devel mailing list
>>> Php...@li...
>>> https://lists.sourceforge.net/lists/listinfo/phpicalendar-devel
> 
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> Phpicalendar-devel mailing list
> Php...@li...
> https://lists.sourceforge.net/lists/listinfo/phpicalendar-devel