I've been cobbling together a system at work for the last couple months to allow a single place for changing all network passwords. This includes a variety of database sources, as well as passwd files and smbpasswd files. I've been making use of PEAR's File_Passwd and File_SMBPasswd, and they've greatly simplified the task of updating passwords for those types of systems. However, I've encountered some issues that I never would have expected.
I have the web user in a group called 'samba', and I have the smbpasswd file owned by root:samba. I then set the smbpasswd file to be group +rw. Simple, right? The web user should then be able to update the smbpasswd file without a problem, right? Wrong.
I kept getting errors, and on investigation continually found that the smbpasswd file permissions had reverted to 0600 -- i.e., only the root user could access it. I tried using 'chattr -i' on the off-chance that the file had been made immutable (which didn't make sense, as I was able to see the permissions change). No luck.
Based on observations of when the permissions reverted, it appears that the various SMB processes will reset the permissions! An example is when someone attempts to mount a resource from the server; this accesses the smbpasswd file to perform authentication -- and at this point the file permissions change. I can find no documentation to support this; these are simply my observations.
So, to get around the behaviour, I created a script that will set the file permissions to what I want them, and then gave sudo privileges to the samba group for that script. This script is then called via system() in the update script just before processing.
It's a hack, and could be made more secure, but it works.
Last week, we performed a long needed upgrade to the company file/print/intranet server. Basically, we'd been on a Redhat 8 system, and there were upgrades we were wanting to perform, and couldn't due to lack of libraries. We could have possibly compiled from source in some occasions... but that would likely have shuttled us into a similar dependency hell as using Redhat in the first place.
So, we decided to re-install the OS, and switch to Gentoo in the process. We've found that Gentoo is a great distro for servers -- it allows us to tailor the install to the server purpose, and simultaneously provides a clean upgrade path via portage.
Things went primarily without a hitch. We lost a few databases due to a bad DB backup (argh! there went the wiki!), but that was the primary extent of the damage.
When investigating the sytem post-install, I discovered some connectivity issues with Samba. Basically, when connecting via a *nix-based machine, we were getting symlinks reported as being local to the connecting machine, not the server. This meant that symlinks on the server weren't being followed -- which caused major issues for those connecting via FTP, Mac, or Linux.
Those who follow my blog may remember an earlier entry on form validation. I looked into some of the possible solutions those who commented provided, but other than Solar_Form, each was either trying to generate HTML, or not generating HTML was considered a plugin type of behaviour (i.e., the HTML generation was the norm, and not generating HTML typically added layers). Discouraged, I continued plugging away on my own solution which was incorporating Solar_Valid for validations, adding some filtering, adding the ability to load definitions from a file, and adding the ability to use callbacks for either filters or validation rules.
I got some code together, tried it out, and felt that either something was missing, or I was doing something a little wrong. I posted the code source, and asked Paul Jones for feedback.
After some initial flurries of emails with Paul asking for more detail, me providing it, Paul asking questions, me attempting to answer... Paul had me look at the source for Solar_Form. In doing so, I discovered what he was suspecting, namely, that we were trying to build something similar. Rather than continue on parallel courses, I decided to jump in and help in this aspect of the Solar project.
This past year, Maeve had a month-long unit on Safaris and jungle animals at daycare. One day, she came home singing:
On Safari, on Safari,
In a jeep, in a jeep,
I can see a lion, I will take a picture,
Click, click, click. Click, click, click.
On Safari, on Safari,
In a jeep, in a jeep,
I can see a tiger, I will take a picture,
Click, click, click. Click, click, click.
And so on.
There's a place just over the Quebec border called Parc Safari that we've been hearing about, and today we went up there on a family outing -- one of the last that we'll have with just the three of us (before little Liam is born).
Not long ago, as Maeve and I were en route to Jen's work one evening, Maeve was being very insistent that certain things were a certain way, and was very adamant even as I used a placating tone with her. I asked her, jokingly, "Why are you so contrary today?" Her reply?
"Because I'm so smart, and because I'm so right."
I almost wrecked the car as I guffawed. Kids. They're so dang cute. And so right!
Changes since the proposal include the addition of a static method for retrieving a random fortune from a list of files, the addition of a DocBook tutorial listing several usage examples, renaming the exception classes to conform to PEAR CS, some minor bugfixes, and some streamlining of the package definition.
Included in the release is an example script, phpFortune, that can be used on the command line to get random fortunes from one or more fortune files. Usage is:
$> phpFortune fortunes $> phpFortune fortunes simpsons hitchhiker $> phpFortune
What a way to start the day -- I had an email from PEPR letting me know that my File_Fortune proposal had been accepted!
File_Fortune is a PHP OOP interface to reading and writing fortune files. It is loosely based on the perl module Fortune.pm, but modified significantly to better work with PHP file access methods, as well as to add writing capability.
I will be uploading my initial release shortly, probably as a beta or RC.
So, go fetch those Simpsons, Hitchhiker's Guide, and Star Wars fortune cookie databases and prepare to add random quotes to your site!
I've been doing a lot of thinking on form validation recently. Among other things, I want to be using a standard set of tools for validating form input at work; I'm also rewriting the family website in PHP, and want to have consistency there as well. Finally, I truly buy into Chris Shiflett's top two security practices: filter input, escape output. Validation should always be done, and should be done rigorously; don't allow anything more than is necessary to get the work done.
I flirted briefly in the past month with HTML_QuickForm. Being an observer on the CGI::Application mailing lists, HQF looks like PHP's answer to perl's Data::FormValidator. HQF has a high frequency of posts on the php-pear-general lists. A lot of people seem happy with it. I decided to try it out as an example plugin for Cgiapp for the latest release.
My problem is that I want to be able to define form validation in a file outside my script. The reason for this is that as I extend and reuse classes, I often find that I can use the same general run-modes for a method... just so long as the form validation logic is separate. This allows me, for instance, to decide that in one application instance I will require fields A-M, but in another, I only need A-E (or vice versa). But it requires no changes to the actual application logic, as the validations are kept separately, and I have the application instance indicate which validation file to utilize.
So, last night, Maeve fell asleep in the early evening, on the couch, clutching her sippy cup and sucking on her bink while watching Scooby Doo. She woke up an hour later, and after she'd been up for a while and was less groggy, she announced to Jen and me that, "I'm not going to use my bink ANY MORE. Every little girl has to give up the bink some time, when they're four, so I'm not going to use the bink EVER AGAIN." (Imagine dramatic pauses between the all-caps words there...)
This coming from the girl who has a fit every time her bink isn't within eyesight and reach. Needless to say, we didn't quite believe her, but we were willing to support her. We told her that if she wants to stop using the bink, that's okay; it's also okay if she decides to use it again. (Fully expecting she'd want it within minutes of going to bed.)
Well... Maeve slept all night without it, and didn't want it this morning, nor in the car. She's adamant, our little warrior queen! (Which is what the Gaelic Maeve translates to in English, in case you were wondering.)
I might be jumping the gun here, but I get the feeling our little girl has taken another step in growing up... and I'm bewildered and a little sad. Much as I've hated the bink the past year, I also associate it with my little girl... and she's getting so she's not so little any more!
UPDATE: I jumped the gun. She did go a full 24 hours, but the following night decided she wanted the bink again. But there is hope for a bink-less future...
I've been doing some thinking on exceptions, and PEAR_Exception in particular. You may want to skip ahead to read about how to use PEAR_Exception, as well as some of my thoughts on the class on first use. If you want the background, read on.
I've created a package proposal on PEAR for a package called File_Fortune, an OOP interface to reading and writing fortune files. I've been using a perl module for this on the family website for years, and now that I'm starting work on the PHP conversion, I thought I'd start with the building blocks.
In creating the proposal, I started with a PHP5-only version, though I found that I wasn't using much in PHP5 beyond the public/private/protected/static keywords. For error handling, I decided to try out PEAR_ErrorStack, as I'd been hearing buzz about it being the new "preferred" method for error handling in PEAR. (Honestly, after using it, I'm not too happy with it; throwing PEAR_Errors was much easier, and easier to manipulate as well -- but that's a subject for another post -- and exceptions were easier still, though more typing.)
The first comment I got on the proposal was the question: "Why PHP5?" (Paul wasn't too surprised by that reaction.) I thought about it, and decided it wasn't really all that necessary, beyond the fact that I'd need to take some extra steps to be able to actually test a PHP4 version. So, I did a PHP4 version.
Well, then some chatter happened, and a number of developers said, "Why not PHP5?" So, I went back to PHP5. And then somebody else said, "Use PEAR_Exception." So, I started playing with that, and we finally get to the subject of this post.