Arricc » PHP

Drupal HTTPS images

Fizzgig — Wed, 02 Mar 2011 23:44:34 +0000

I was involved with a project for a while which was using Drupal as the CMS. The entire site was being served over HTTPS, which was quite annoying as a large pile of the images that were being posted were being served over HTTP from their respective webservers. Naturally, this resulted in everyone getting very annoyed at their browser warning about loading unsecured content on a secure page.

So, I came up with this module. I’ve been meaning to release it for ages, but as I need to clear down the server it was running on it’s made me take the five minutes to write this post. Still needs a bit of work, but does what it says on the tin.

It identifies non-local images in content, downloads them and serves them from a local cache.

Download the module here: img_proxy.tar.gz

If you use Drupal, you should already know the drill – extract the file to your modules directory and enable it in the modules page. The module is implemented as an input filter, so you will then have to add it to the appropriate input formats at http://your.site.com/admin/settings/filters

Notes

Licenced under the GPL version 2.
*** There is nothing in the code that verifies the file being proxied is an image!! *** (that’ll be in the next version!)
May not work with sites that check the referer of the request for images.
I’ve been meaning to release this for ages, but there is sill a lot of debug code thats just commented out.

Hopefully I’m not the only webmaster that ever had this issue and somebody will find this handy.

Maybe one day I’ll tidy up the code and submit it to the Drupal Module repository!

Enjoy.

If you find this article useful, buy me a beer!

WordPress Front Page Single Post

Fizzgig — Fri, 11 Sep 2009 13:03:03 +0000

Well, I’ve rejigged my site theme, and I decided to play a bit with the layout.

The look of the site seemed to be better with just the excerpt from a single post on the front page.

Now, that sounds really straight forward and something that WordPress should be able to do out of the box. And it is.

However, if you want the “Older Entries” pages to then show, say, 10 posts you’re knackered as all subsequent pages will just show 1 entry. I tried the Custom Post Limits plugin, but it still didn’t work as page 2 started at post 6.

After reading a lot of entries on this topic (it seems I’m not the only person keen on this!) and getting nowhere fast. Lots of “read this link then work it out yourself” type replies I finally got something to work. Using both the offset AND paging attributes of the query_posts() function!

The only issue with this is that the last page wouldn’t show at all. This was due to the fact that the front page misses all but 1 of the entries, then the 2nd page starts at entry 2. In effect you’re missing a number of entries up to the usual number per page minus 1 – everything that would be on the last page. To get round this, I simply double the number of entries displayed on what WordPress believes is the final page.

To get this to work, add the following snippit to the top of the home.php file in your theme directory.
If you don’t have a home.php file then copy your index.php in your theme directory to home.php which will then take precedence according to the WordPress Template Heirarcy. I do not recommend adding this to your index.php file.

//WATCH THAT LINE WRAP!
if (is_home()) {
        $page = (get_query_var('paged')) ? get_query_var('paged') : 1;
        if ($page == 1) {
                query_posts("showposts=1&paged=$page");
        } else {
                $numposts = get_option('posts_per_page');
                //Work out what posts to show first on the page.
                $offset = (($page -1) * $numposts) - ($numposts -1);
                //Quick hack to display double the number of posts on the last page as the offset hides posts per page -1.
                if ($page == $wp_query->max_num_pages) {
                        $numposts = 2* get_option('posts_per_page');
                }
                query_posts("offset=$offset&paged=$page&showposts=$numposts");
        }
}
?>

If you find this article useful, buy me a beer!

Exchange Guid converter tool

Fizzgig — Tue, 18 Sep 2007 01:13:40 +0000

In response to the amount of comments I’ve had (which are way way more than I was ever expecting!) on my Exchange Mailbox Recovery article, I’ve written a script to convert your guids from the bad format that exmerge gives you to the one thats required for updating the user account.

You can access it here. Please leave any feedback on this post.

If you find this article useful, buy me a beer!

LastFM for Drupal

Fizzgig — Wed, 22 Aug 2007 23:51:54 +0000

So, I’ve been playing with Drupal recently.

At first it did my head in, but then something sorta clicked. Not been near the Taxonomy module yet, but when I do I expect that process to reverse.

Anyway, I decided I needed a module that will allow users to show their LastFM stuff on their profile pages. I couldn’t find one so I wrote one.

I stared out with the Onlinestatus module as it did something very similar to what I was hoping to achieve.

Anyway, the module is attached should you feel so inclined. (Requires the profiles module I think. The one I based it on does anyway, so it probably does too.)

Download: lastfm.tar.gz

If you find this article useful, buy me a beer!

User VHosting

Fizzgig — Tue, 29 Aug 2006 23:05:50 +0000

So, previously, I detailed how to do web virtual hosting to directories on the file system. This is all well and good, but I want to have users pidgeon holed into their own directories, plus I want users own websites to be stored under their own directories in a similar format to that used in the previous article (eg. /home/user/web/example.org/subdomain)

The problem lies with mapping domain names (example.org) onto user accounts (Alice? Bob?). This is where Apache and mod_rewrite come to the rescue again. On Wintermute I’ve installed Apache 2, but this recipe will work just as well with Apache 1.3.

First, we create a file with domain names to username mappings:
/etc/apache2/map.hosted

wintermute:/etc/apache2# cat map.hosted
xeno-phon.co.uk: jimsin
starfallonline.co.uk: stillborn
ryanroberts.co.uk: stillborn
witchhunter.co.uk: stillborn
flushedphoenix.co.uk: flushedphoenix
shawree.co.uk: shawree
theballswinger.co.uk: the_ball_swinger
the-hearse.com: hobgoth

The pattern is “website.com: username” with one per line.
Each of these usernames must also exist in the Xoops database (or as system users), but I’ll be covering the links to that DB in a later article.

Coming up with that file was the easy bit. The next bit was the major pain in the hole. I searched for aaaages to try and work out how to do this in php ( my php is significantly better than my Perl), but all the examples I could find were written in Perl. So, here are some keywords for search engines: how to write a mod_rewrite map in php not perl. php apache rewritemap.

#!/usr/bin/php

//Optional log file.
#$log = fopen ("/tmp/rwlist",'a');
//Map file
$mapIn = fopen("/etc/apache2/map.hosted", "r");
//Read in the file.
//NB: This is only done at startup, so if you change the file you have to reload Apache to get the changes recognised.
while (($data = fgetcsv($mapIn, 1000, ":")) !== FALSE) {
        $map[$data[0]] = trim($data[1]);
}
fclose($mapIn);
//Recursive function. Starts with the full domain name and gradually pops off segments until it finds an owner (or not).
//eg. www.sub.example.org - first checks for www.sub.example.org, then sub.example.org, then example.org and finally org.
function checkUser(&$url)
{
        global $map;
        $uname = $map[$url["host"]];
        if ($uname <> "")
        {
                $url["hostedUser"] = $uname;
        }
        else
        {
                $host = explode(".",$url["host"]);
                $url["path"] = "/". $host[0] . $url["path"];
                unset($host[0]);
                $url["host"] = implode(".",$host);
                if ($url["host"] <> "")
                        checkUser($url);
        }
}
do
{
        $in = trim(fgets(STDIN,8096));
        if (strlen($in) >0)
        {
//Log request
#               fputs($log, "$in\n");
                unset($url["hostedUser"]);
                if (substr($in,0,1) <> "/")
                {
                        $in = "http://$in";
                        $url = parse_url($in);
                        $path = $url["path"];
                        $url["path"] = "";
                        checkUser($url);
                }
                //If we find an owner
                if(isset($url["hostedUser"]))
                {
                        //This bit is slightly legacy before I moved the hosting files about a bit. Kept for posterity mainly.
                        $out = "/home/" . $url["hostedUser"] ."/web/" . $url["hostedUser"] . ".elizium.net/" . $url["host"] . $url["path"] . $path;
                        if (file_exists("/home/" . $url["hostedUser"] ."/web/" . $url["host"] . $url["path"] . $path))
                        {
                                $out = "/home/" . $url["hostedUser"] ."/web/" . $url["host"] . $url["path"] . $path;
                        }
                }
                //Otherwise just return this file as 99% chance its some automated script looking for exploitable webapps.
                else
                        $out= "/var/www/monkey.txt";
//Log resulting path
#               fputs($log, "$out\n");
                fputs(STDOUT, "$out\n");
        }
//Just keep doing it forever.
} while (true);
?>

The only improvement I may make to that is to get the users home directory info as opposed to assuming its under /home.

Now we just need put that script somewhere, make it executable by the Apache user and tell Apache to use it. Thats done like so:

RewriteEngine on
#Use this program to do the mappings
RewriteMap      hosted          prg:/etc/apache2/map.hosted.php
#This is for allowing www.user.elizium.net type urls as they're outwith the scope of the rewrite script as they're easy to map.
#See http://forum.modrewrite.com/viewtopic.php?t=1652&postdays=0&postorder=asc&start=10
RewriteCond %{HTTP_HOST} !^(www\.)?elizium\.net$ [NC]
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{HTTP_HOST} ^([^\.]+\.)?([^.]+)\.elizium\.net$ [NC]
RewriteRule .*  /home/%2/web/%2\.elizium.net%{REQUEST_URI}      [QSA,L]
#Ignore *.elizium.net
RewriteCond     %{HTTP_HOST}    !elizium.net$ [NC]
#Use the full request
RewriteRule     ^(.+)           %{HTTP_HOST}$1  [C]
#Throw the request through the map program
RewriteRule     ^(.*)           ${hosted:$1}    [L,C]

I hope this is of use to people. Especially those folk looking for a php based rewrite script for Apache. Theres a lot of scope to expand the script. For example, the file data could be retrieved from a database and then stored in something like memcached if you were performing this sort of thing on a larger scale. Much better than having a large webserver config file that means the webserver has to be reloaded for each change.

The only problem I have with this, and I know its not insurmountable, is that the webserver user has to be able to read the files that users are storing. To allow this I’ve made the www-data user a member of the group all the users are members of. This also means that users can read each others files. So if somebody was to hardcode a password in a php file (for example) then it would be open to being read by any other user.

I also want to mention suPHP, it really does merit an article to itself, but as I’m not intending to cover it in depth (you can read all about it at the website) I’ll just say that I’ve enabled it on Wintermute to prevent users being able to do things like kill the web server processes via a php script. To do that, I installed the suphp-common Debian package. The default configs are all you need. For the non-Debian user, they look like this when taken together:

LoadModule suphp_module /usr/lib/apache2/modules/mod_suphp.so
 mod_suphp.c>
        suPHP_Engine on
        AddHandler x-httpd-php .php .php3 .php4 .phtml
# # Use a specific php config file (a dir which contains a php.ini file)
        suPHP_ConfigPath /etc/php4/cgi/

As usual comments on the above are most welcome. Especially quick links about solving my security issue!

If you find this article useful, buy me a beer!