Re: Adding PHP to each webpage
Patrick Gerlier <[email protected]>
| Newsgroups | gmane.comp.genealogy.gramps.user |
|---|---|
| Message-ID | <[email protected]> |
Hi,
Don't know if you're still looking for a solution. I have a similar
requirement and solved it (partially) without modifying the web pages.
I'm using NginX under Linux and I want to split my pages between public
and private ones. In addition, readers have not all the same
permissions, i.e. members of some lineage should be able to see only
their lineage so that unrelated readers can't access private data on
foreign (living) people.
I customised my NginX configuration file to reroute all *.html requests
for a genealogy webpage to a small FCGI filtering script. This script
retrieves the page from the directory where it is stored, build the DOM
and checks the <meta> tags in the <head> element of the page. If no
special tag is found, the page is public and returned to NginX.
If a <meta name=lineage content="…"> is found, the page is "private" and
credentials should be checked.
On first encounter, an authentication page is returned to NginX while
state data is stored in a small SQLite database. A "tagging cookie" is
attached to the page as the key to the DB record. The cookie will time
out after 5 minutes to protect against replay attacks or substitution of
remote user.
Authentication is a form requesting a user name and a password. Of
course, these credentials are transmitted in HTTPS.
When NginX sees the answer (destination is a special URL), it reroutes
it to the aforementioned FCGI script with "annotations" in CGI
variables. From the key in the cookie, the script retrieves the details
of the initial request and checks no time out occurred. Password is
validated against user properties in the DB and the list of allowed
lineage is recovered. If the <meta> tag and the list have a non-void
intersection, access is granted and the initial page is returned.
Three password attempts are allowed. After this, user is locked for 30
minutes.
To avoid soliciting authentication on every page, a different cookie is
returned with the "private" page granting free access (on the same
lineage) during 15 minutes.
The cookies are fully random to prevent replay access. They don't carry
any usable data. They only are a temporary key for the SQLite DB.
Everything is done in the server; no script of any kind on the remote.
It should be pretty safe.
User management is done directly in the SQLite DB with a tool like
Sqliteman wher you enter only a user name, a password and a string
containing the allowed lineage-ids.
The only point remaining to implement is a patch in the NarrativeWeb
report to add the <meta> tags when specific attributes are detected.
I've checked the correctness of the behaviour on pages where I manually
added <meta> tags. Generating automatically the tags calls for special
care so that private information doesn't leak through references to
other reports (such as the list of all persons or persons/events related
to some place). I have not begun working on this aspect.
Note: by "private" data, I don't mean records marked private (which is a
strict generate/don't generate switch) but a more subtle mechanism where
some page may be read by some and forbidden to others. This is why I
must use Gramps attributes.
To summarise, I worked around the difficulty to insert various snippets
inside the pages by delegating monitoring page usage to an external
script. This needs only a (at first sight, not considering leakage)
small change in NarrativeWeb report to process specially some attribute.
If you're interested, we could collaborate on this.
Patrick
Le 25/12/2021 à 15:05, David Denholm a écrit :
> I am hoping to use better minds than mine to find a solution:
>
>
>
> I have a PHP secure website which uses a MySQL database. To ensure the
> pages are served securely I need to add the following (in red if this works)
> to the top of every webpage in the narrated web as produced by Gramps.
>
>
>
> <?php require_once('../../private/initialize.php'); ?>
>
> <?php $page_title = 'Family Tree'; ?>
>
> <?php include(SHARED_PATH . '/staff_header.php'); ?>
>
>
>
> [I would like to add the following to the end of every page in the narrated
> website, but this is not critical:
>
>
>
> <?php include(SHARED_PATH . '/staff_footer.php'); ?>
>
>
>
> Is there any way to do this within GRAMPS? Or is there another way?
>
>
>
> [For anyone more technically minded the staff_header.php includes the PHP to
> require_login() and this makes sure that the page cannot be served without
> the user being logged on (I could put this in each webpage directly but I
> still have the same problem about how to add a standard bit of PHP in each
> page. (I am using nginx, and I have been advised that using htaccess would
> be inefficient.)]
>
>
>
> Can anyone point me in the right direction?
>
>
>
> Thanks (and by the way - Happy Christmas!)
>
>
>
> David
>
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: smime.p7s
> Type: application/pkcs7-signature
> Size: 5977 bytes
> Desc: not available
>
--
Gramps-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/gramps-users
https://gramps-project.org