Christopher Imrie's Blog

I’m giving up freelancing and joining Moresoda!

Sun, 16 Jan 2011 1:50:11 +0000

I have just recently announced that as of next week I will be giving up freelancing to join the Bath, England based Moresoda as their lead developer! To commemorate the event I knocked up the poster above.

Its inspired by the early work of James White.

Photoshop Vanishing Point and 3D Layers

Sun, 07 Nov 2010 1:43:42 +0000

In this video I show how to use vanishing point to turn your photo into a 3D model that you can move & rotate in 3D space.

Extending flashdata in CodeIgniter

Thu, 28 Oct 2010 17:38:22 +0000

Following on from my previous article explaining how I achieve a very transparent security and authentication system in CodeIgniter (CI), I thought I would also post another of my custom libraries that I use in nearly every custom CI application.

CodeIgniter comes with a Session class that includes a flashdata feature. Flashdata is really handy as it allows us to show a message for the next page request, but then have it removed for any requests thereafter. So if we try to insert something in the database, and succeed, we can set flashdata message to give feedback along the lines of "Database insertion successful". This will only be show for a single page load, and as the user navigates away, the message will be hidden and hence not shown.

The current flashdata methods allow us to give the message both "name" and "message" properties. So if an error occurs, we can set a message with the name "error" and then in the message describe the error to the user. We could do the same for giving feedback when something succeeds, but instead we would give this a name of "success".

In our templates we could then simply detect for the presence of either a "success" or "error" message. However, we are most likely going to want to style it at the same time. So you will end up with something like this at the top of your templates:

session->flashdata('success')){
        
        echo "" . $this->session->flashdata('success') . "";
        
    }elseif($this->session->flashdata('error')){
        
        echo "" . $this->session->flashdata('error') . "";
        
    }
?>

This is a little too verbose for my liking, since this is likely to be on every page if you are building some sort of control panel. Also having to place the delimiters (the HTML tags that wrap the message) in the conditional doesnt look right. It would be more useful to be able to have the flashdata know whether it was a success or an error, and then wrap the message in a html tag with an error/success class that would allow us to style it.

A better way

By creating a custom class that extends the native CI Session class, we can create out own flashdata methods. Here is one that I use regularly, and has never let me down:

 $newval);
		}

		if (count($newdata) > 0)
		{
			foreach ($newdata as $key => $val)
			{
				$flashdata_key = $this->flashdata_key.':new:'.$key;
				$this->set_userdata($flashdata_key, "".$val."");
			}
		}
	}
	
	/**
	 * Add or change error flashdata, only available
	 * until the next request
	 *
	 * @access	public
	 * @param	mixed
	 * @param	string
	 * @return	void
	 */
	function set_error_flashdata($newdata = array(), $newval = '')
	{
		if (is_string($newdata))
		{
			$newdata = array($newdata => $newval);
		}

		if (count($newdata) > 0)
		{
			foreach ($newdata as $key => $val)
			{
				$flashdata_key = $this->flashdata_key.':new:'.$key;
				$this->set_userdata($flashdata_key, "".$val."");
			}
		}
	}
}

Simply save this file as "MY_Session.php" and place it in your /system/application/libraries folder. If you have left the CI config settings concerning custom library loading untouched, then CI will automatically load this file at runtime.

Now whenever you want to set success or error flashdata from your controllers/models, simply call:

//Set a success message
    $this->session->set_success_flashdata('feedback', 'Success message for client to see');
    
    //Set an error message
    $this->session->set_error_flashdata('feedback', 'Error message for client to see');

Things get really nice and simple in your templates, since now you can skip any conditionals and simply call a single method:

session->flashdata('feedback');
?>

The output from the method above will produce a message already wrapped in a paragraph containing the correct success/error class. Much simpler!

Implementing secure, password protected controllers in CodeIgniter

Sun, 24 Oct 2010 14:46:28 +0000

My day to day activities as a freelance web developer have me doing all sorts of things from converting Photoshop files to XHTML & CSS, to adding Javascript interactivity all the way to writing custom web apps. The latter is the most mentally satisfying for me since each web application has a different need to the next, and requires solving a unique set of problems.

I build all my web applications using the CodeIgniter framework due to its robustness, flexibility and speed. If you are a PHP developer and have not come across it before, I highly recommend you check it out since it's a great framework to work with.

A common need amongst web applications is the need for password protected areas of your web application. Coming up with a good security structure within CodeIgniter can be tricky for those new to the framework since there is no clear method to doing so. I am not saying that the framework is lacking, merely that the creators (the lovely folks at EllisLab) have left the framework in such a state that it makes no assumptions on its use, and therefore it is up to you the developer to implement your own security model.

The model I have developed has the following features:

Supports both secure and unsecure controllers (for public areas of your site)
No modification of core files
CodeIgniter library can be upgraded with new releases without breaking the security model
Un-authenticated URL requests are intercepted, shown a login screen, then redirected to the original URL
Controllers are kept "security code" free.

Transparency

Having built many web applications over the years, I have implemented many different sorts of security models, each with varying degrees of transparency to my day to day working. When I refer to transparency, I refer to the awareness of the developer that the security model is in place. If I have to copy and paste a security check and redirect script into the top of every file I wish to be protected, then this is very un-transparent in its implementation. I am very aware that there is a security check at the start of each file. Not only that, it means that if I wish to change the nature of the security (eg: add a new feature) I have to modify the code on every single file that needs to be secure. Not only is this inefficient, it is prone to errors and mistakes.

The method I am going to show you is the complete opposite of what I describe above. The security is loaded silently in the background and your controllers only need three characters added to them in order to inherit the protection for the security system. Therefore I can work in my CodeIgniter controllers without any extraneous security code getting in the way.

Keeping things as secure as possible

In order for the method I show you to have the best security, make sure you have the following setup:

Session library is autoloaded (More info)
Session data is saved to the database (More info)
Session data is encrypted in your session preferences (More info)

How it works

The system works by extending the CodeIgniter Controller class and having any secure controllers extending from this new class. Therefore make sure that in your preferences you have set your Class Extension Prefix to the following (this is the default, so it probably wont have changed):

$config['subclass_prefix'] = 'MY_';

This will allow us to have the custom controller loaded automatically by CodeIgniter on each page load.

Custom Controller

Here is the first file, it is a custom controller that extends the default controller file. I have commented it as extensively as I can and pointed out where you need to add your own customized code. You need to save this file as MY_Controller.php and place it in your ./system/application/libraries/ folder.

session->userdata('logged_in')){

            // ====================
            // = Login has failed =
            // ====================

            // If not logged in, record what url they are attempting to acces and show the login form
            $this->session->set_userdata('REDIRECT' , uri_string());

            // Give the browser an Unauthorized HTTP header
            $this->output->set_status_header('401');

            // Redirect to the login page, change this to your login controller/method
            redirect('login');

        }else{
            
            // =======================
            // = Login has succeeded =
            // =======================
            
            //This is optional, but I have a method that sets up some constants
            $this->_login_init();

        }
    }
	// END MY_Controller method
    
    /**
     * Performs all login functionality such as setting up constants
     *
     * @return void
     * @author Christopher Imrie
     **/
    private function _login_init()
    {
        // I have a model designed to fetch user data.  Since I am logging a user in,
        // I am loading it here and fetching the user's data
        $this->load->model("users");
        
        
        // I call a method here to setup some constants to be available to all secure controllers
        if($userdata = $this->users->get_userdata($this->session->userdata('username')))
        {
            //If we have data, then setup the constants or do special functionality in here
            
            
            // ===========
            // = Example =
            // ===========
            
            /**
            * Logged in users email
            **/
            // define('USERNAME', $userdata->username);


        }else{
            // ===========================
            // = Error fetching userdata =
            // ===========================
            
            //Destroy the session
            $this->session->sess_destroy();

            //Log it
            log_message('error', 'Session error.  Session id not found');
            
            //Show it
            show_error('Session error, please log in again.');
        }

    }
    // END _login_init method
}
// END MY_Controller class

/* End of file MY_Controller.php */
/* Location: ./system/application/libraries/MY_Controller.php */

Login Controller

For clarity I have also included the login controller that functions as the login screen. This file is to be named login.php and placed in your ./system/application/controllers/ folder.

session->userdata('logged_in') && $this->session->userdata('username'))
        {
            // ===========================
            // = User is still logged in =
            // ===========================
            
            //Dont bother with the login page, just send em on to the start page
            redirect('start');
            
        }else{
            // =========================
            // = User is not logged in =
            // =========================
            
            // Lets use the form validation library to keep things simple & robust
            $this->load->library('form_validation');
            $this->form_validation->set_rules('username', 'Username', 'required|callback__verify_username_password');
            $this->form_validation->set_rules('password', 'Password', 'required');
            
            //We have a custom method that is checking the username & password validity
            $this->form_validation->set_message('_verify_username_password', "Username or password is incorrect");

            if(!$this->form_validation->run())
            {
                // ====================
                // = Login has failed =
                // ====================
                
                //Load up the login screen
                $this->load->view('login_view');
            
            }else{
                // =======================
                // = Login has succeeded =
                // =======================
                
                //Set our custom session userdata to be checked by our secure controller
                $this->session->set_userdata('logged_in' ,TRUE);
        		$this->session->set_userdata('username' , $this->input->post('username'));

                
                // =================================
                // = Redirect based on user intent =
                // =================================
                
                //Check if user was trying to access a specific URL before login procedure
                if($this->session->userdata('REDIRECT'))
                {
                    //Save the REDIRECT
                    $redirect = $this->session->userdata('REDIRECT');
                    
                    //Unset the REDIRECT otherwise we end up in a loop
                    $this->session->unset_userdata('REDIRECT');
                    
                    //Away we go..!
                    redirect($redirect);
                    
                }else{
                    
                    // There is no REDIRECT set, just send em to the start page
                    redirect('start');
                    
                }
            }
        }
    }
    // END index method
    
    
    /**
     * Verifies that the username and password are correct
     *
     * @return void
     * @author Christopher Imrie
     **/
    function _verify_username_password($str)
    {
        $username = $str;
        $password = $this->input->post('password');
        
        /*
         * Perform your username and password check here.
         * 
         * Fetch stuff from the DB, or do whatever you like as long as you return TRUE/FALSE
         */
         
         //return TRUE / FALSE;
    }
}
// END Login class

/* End of file login.php */
/* Location: ./system/application/controllers/login.php */

This is a very bare bones login controller but it will do the trick very nicely and crucially sets up some session userdata that is checked by the custom controller I showed you above. Simply create a view named login_view.php (or modify the code above to suit your naming structure) and have this show a form with username and password fields. You will also need to fill in the _verify_username_password() method with your own verification code and then return TRUE/FALSE to indicate a successful username & password match.

Creating a secure controller

Now that those two controllers have been setup, the act of creating a secure controller is a breeze. Simply have any page that to be protected extend from the secure class like so:



	Notice that this class extends from MY_Controller, and not from Controller, as is usual with controllers in CodeIgniter.  This simple addition of "MY_" to the Controller key word will completely protect this controller from any unauthorized access.

	If any user tries to access a controller that extends from My_Controller, the request will be intercepted, routed to a login page and then sent back to their original url request once authorization has been completed.

Sending ExpressionEngine 1.6.x templates through the Communicate panel

Wed, 25 Aug 2010 14:55:07 +0000

Further on from an article I wrote a while ago about how to send templates via email through the EE2.0 control panel, I've seen requests for how to do this in EE1.6.x.

I originally developed the method to achieve this functionality for EE1.6.x, and I then ported it and refined it for EE 2.0, so I am only too happy to share my original code if it helps someone.

The code will add a drop down list of templates from a specified template group and when the user selects one, it will show the user a preview of the rendered email where they normally compose their email. You can even get this little snippet to automatically set the "From" email address and name. This is very handy for consistency.

Few of things you will need before you add the code below:

Make sure jQuery for the Control Panel is enabled.
Make sure your email settings in the EE admin area are set to automatically send Emails as "HTML" and that "Word Wrap" is switched off.
Ajax loader image. You will need to upload an ajax image loader to your server. I recommend downloading and using this one, since it is the right size. Change the $loaderImage path to point to this image.
The code below will create a drop down list of all templates in a specified group. This is handy for what i needed since I had a template group called "newsletters" and in there I put various email templates the client could select to send. Set the $templGroup to the template group ID you want listed.
You can optionally set the $autoFromEmail and $autoFromName to values that will auto populate the "From Email" and "From Name" respectively. You will need to uncomment the respective commands further in the code to enable this (there are comments to show you where).

Disclaimer: As you would expect, this is a bit of a hack, so if you update EE you will need to reapply this code each time. Also you apply this at your own risk and I am not responsible for any damage made to your Database due to modifications made to the code below.

Open up the file: system/cp/cp.communicate.php

Around line 419 you will see the following code:

if ($DSP->allowed_group('can_email_mailinglist') AND $this->mailinglist_exists == TRUE)	  
    {

Immediately after this add the following code, and update the config variables as I explained above:

//-- ================================================================ -->
//-- =             CUSTOM TEMPLATE VIA EMAIL CODE                   = -->
//-- ================================================================ -->

  //Config
  $templGroup = 13;
  $loaderImage = "/images/public/ajax-loader.gif";
  $autoFromEmail = 'noreply@youremail.com';
  $autoFromName = 'Company Name';
  //
  
  
  $sql  = "SELECT tg.group_id, tg.group_name, t.template_id, t.template_name
       FROM exp_template_groups tg , exp_templates t
       WHERE tg.group_id = t.group_id
       AND tg.site_id = '".$DB->escape_str($PREFS->ini('site_id'))."'";
  $sql .= " AND tg.group_id ='" . $templGroup ."'"; 
  $sql .= " ORDER BY tg.group_order, t.group_id, t.template_name";  
  $query = $DB->query($sql);

  $r .= $DSP->table('tableBorder', '0', '', '300px').
      $DSP->tr().
      $DSP->td('tableHeading').
      $DSP->qdiv('itemWrapper', "Template").
      $DSP->td_c().
      $DSP->tr_c();

    $style = ($i++ % 2) ? 'tableCellOne' : 'tableCellTwo';

    $r .= $DSP->tr().
        $DSP->td($style, '50%')."Select Email Template: "."