RE: [PHP] Problem with ssh2_connect

2010-06-24 Thread Radek Krejča
Hi, new symptoms...

So, I have following:

1. created rsa keys - tested over ssh command - on remote server is public key 
renamed to authorized_keys, on local machine i have both keys
2. rights on local machine:
-r   1 radek  wheel   1675 23 led  2007 radek
-r   1 radek  wheel229 24 crv 10:05 radek.pub

3. rights on remote machine
-r  1 radek  wheel   402 Jun 26  2006 authorized_keys

4. script

 'diffie-hellman-group1-sha1',
  'hostkey' => 'ssh-dss',
  'client_to_server' => array(
'crypt' => '3des-cbc',
'mac' => 'hmac-md5',
'comp' => 'none'),
  'server_to_client' => array(
'crypt' => '3des-cbc',
'mac' => 'hmac-md5',
'comp' => 'none'));

$connection = ssh2_connect('test.starnet.cz', 22, $methods);

if (ssh2_auth_pubkey_file($connection, 'radek',
  '/home/radek/.ssh/radek.pub',
  '/home/radek/.ssh/radek')) {
  echo "Public Key Authentication Successful\n";
} else {
  die('Public Key Authentication Failed');
}
?>


5. result of script
php pokus.php 
Assertion failed: (session->userauth_pblc_method_len == 
_libssh2_ntohu32(pubkeydata)), function userauth_publickey, file userauth.c, 
line 982.
Abort trap: 6 (core dumped [obraz pameti ulozen])


6. if i use method ssh-rsa, i got message written in latest e-mail

7. both computers are FreeBSD, php from fresh ports

8. connection to Mikrotik over password (I cant use it there) withou problem 
(with this methods of course):

$methods = array(
  'kex' => 'diffie-hellman-group1-sha1',
   'client_to_server' => array(
   'crypt' => '3des-cbc',
   'comp' => 'none'),
   'server_to_client' => array(
   'crypt' => 'aes256-cbc,aes192-cbc,aes128-cbc',
'comp' => 'none'));


What I have wrong?
Thank you

Radek
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



RE: [PHP] Problem with ssh2_connect - finished

2010-06-24 Thread Radek Krejča
Hi, so I have (hope) finished. There is problem with rsa keys in function 
ssh2_connect (probably bug, I dont see any problem on my side), so I created 
two pairs - rsa and dsa. rsa method isnt working, but dsa method without 
problems.
Its little complication, because I have everwhere rsa keys, but I change it to 
dsa, If nobody doesnt have any idea, where could be a problem with rsa.

Radek
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[PHP] Quick session question

2010-06-24 Thread Danny
Hi guys,

I always start new projects with the following session code-snippet:
(In other words this is how I initialize my sessions in the index.php file.)

### START CODE SNIPPET 
http://localhost/~user/new_project"; ;
$_SESSION['sql_dflts'] = $_SESSION['server']."/sql/sql_dflts.inc" ;
$_SESSION['remoteaddr'] = $_SERVER['REMOTE_ADDR'] ;
$_SESSION['remotehost'] = gethostbyaddr ( $_SERVER['REMOTE_ADDR'] ) ;

/// Include Files
include ( $_SESSION['sql_dflts'] ) ;
include ( $_SESSION['server']."/fnc/fnc_include_dir.inc" ) ;
$var_include_dir = include_dir ( "fnc" ) ;

?>
### END CODE SNIPPET #

All of the projects I have done so far were for business intranet purposes and
it worked fine. But last week I uploaded another project to the internet and my
sessions did not work.

I have been using it this way since v4.0 (I think, anyway since a LONG time
ago), but now I think it is a bit outdated and needs some kind of revision. Is
this still sufficient or can you guys give some tips on a more "updated" way of
starting my sessions?

My php.ini file is stock-standard. I am running version 5.2.6-1 with apache
2.2.9 on a Debian 5.04 machine.

Thank You

Danny

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Quick session question

2010-06-24 Thread Ashley Sheridan
On Thu, 2010-06-24 at 16:24 +0200, Danny wrote:

> Hi guys,
> 
> I always start new projects with the following session code-snippet:
> (In other words this is how I initialize my sessions in the index.php file.)
> 
> ### START CODE SNIPPET 
> 
>session_start();
>   setcookie(session_name(),"",0,"/");
>   unset($_COOKIE[session_name()]);
>   $_SESSION = array();
>   session_unset();
>   session_destroy();
> 
>   session_start();
> 
> 
>   /// Define some $_SESSION variables
>   $_SESSION['sessionid'] = session_id() ;
>   $_SESSION['server'] = "http://localhost/~user/new_project"; ;
>   $_SESSION['sql_dflts'] = $_SESSION['server']."/sql/sql_dflts.inc" ;
>   $_SESSION['remoteaddr'] = $_SERVER['REMOTE_ADDR'] ;
>   $_SESSION['remotehost'] = gethostbyaddr ( $_SERVER['REMOTE_ADDR'] ) ;
> 
>   /// Include Files
>   include ( $_SESSION['sql_dflts'] ) ;
>   include ( $_SESSION['server']."/fnc/fnc_include_dir.inc" ) ;
>   $var_include_dir = include_dir ( "fnc" ) ;
> 
> ?>
> ### END CODE SNIPPET #
> 
> All of the projects I have done so far were for business intranet purposes and
> it worked fine. But last week I uploaded another project to the internet and 
> my
> sessions did not work.
> 
> I have been using it this way since v4.0 (I think, anyway since a LONG time
> ago), but now I think it is a bit outdated and needs some kind of revision. Is
> this still sufficient or can you guys give some tips on a more "updated" way 
> of
> starting my sessions?
> 
> My php.ini file is stock-standard. I am running version 5.2.6-1 with apache
> 2.2.9 on a Debian 5.04 machine.
> 
> Thank You
> 
> Danny
> 


>From the looks of it, any values that you add to the session are
forgotten again the next time this code is called because of your use of
session_unset() and session_destory(). Generally these functions are
only used if you are closing the session.

When you say 'sessions did not work' what do you mean? Sessions aren't
being created? You can't access session variables? You need to be a bit
more specific about the issue.

Thanks,
Ash
http://www.ashleysheridan.co.uk




Re: [PHP] Quick session question

2010-06-24 Thread Jim Lucas
Danny wrote:
> Hi guys,
> 
> I always start new projects with the following session code-snippet:
> (In other words this is how I initialize my sessions in the index.php file.)
> 
> ### START CODE SNIPPET 
> 
>session_start();
>   setcookie(session_name(),"",0,"/");
>   unset($_COOKIE[session_name()]);
>   $_SESSION = array();
>   session_unset();
>   session_destroy();
> 
>   session_start();
> 
> 
>   /// Define some $_SESSION variables
>   $_SESSION['sessionid'] = session_id() ;
>   $_SESSION['server'] = "http://localhost/~user/new_project"; ;
>   $_SESSION['sql_dflts'] = $_SESSION['server']."/sql/sql_dflts.inc" ;
>   $_SESSION['remoteaddr'] = $_SERVER['REMOTE_ADDR'] ;
>   $_SESSION['remotehost'] = gethostbyaddr ( $_SERVER['REMOTE_ADDR'] ) ;
> 
>   /// Include Files
>   include ( $_SESSION['sql_dflts'] ) ;
>   include ( $_SESSION['server']."/fnc/fnc_include_dir.inc" ) ;
>   $var_include_dir = include_dir ( "fnc" ) ;
> 
> ?>
> ### END CODE SNIPPET #
> 
> All of the projects I have done so far were for business intranet purposes and
> it worked fine. But last week I uploaded another project to the internet and 
> my
> sessions did not work.
> 
> I have been using it this way since v4.0 (I think, anyway since a LONG time
> ago), but now I think it is a bit outdated and needs some kind of revision. Is
> this still sufficient or can you guys give some tips on a more "updated" way 
> of
> starting my sessions?
> 
> My php.ini file is stock-standard. I am running version 5.2.6-1 with apache
> 2.2.9 on a Debian 5.04 machine.

Nothing looks to be wrong with the session initiation code.  The problem is more
the likely the calls to include a remote file.  Basically, to expand your
variables out, you would be doing this:

include ( 'http://localhost/~user/new_project/sql/sql_dflts.inc' ) ;
include ( 'http://localhost/~user/new_project/fnc/fnc_include_dir.inc' ) ;

If your php.ini settings are stock, then the problem is with the
allow_url_include directive.  It is set to "0" by default.

See here: http://us3.php.net/manual/en/filesystem.configuration.php

Change that setting to '1' and restart your web server, then you should be good
to go.

> 
> Thank You
> 
> Danny
> 


-- 
Jim Lucas

A: Maybe because some people are too annoyed by top-posting.
Q: Why do I not get an answer to my question(s)?
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Quick session question

2010-06-24 Thread Danny
Thanks Ashley and Jim,

> When you say 'sessions did not work' what do you mean? Sessions aren't being
> created? You can't access session variables? You need to be a bit more 
> specific
> about the issue.

Sorry, here is an explanation:

The project I uploaded for a customer is a "stock ordering" web-app that they 
used
on their local intranet for a year or so, but now they want this same web-app to
be available globally.

I thought that it would work "out-the-box" on the internet but it doesn't. On
their local-lan I am able to do some (advanced) login checks with sessions with 
no
problem, like I said, it has been workng for a year or so now. Also, the same
login sequence I use here I also use in my other intranet web-apps.

However, when I uploaded this project and I log on, I just get a blank screen
after the login checks are done and it is supposed to take me to the logged-in
start page.

That is why I say that somehow my sessions are not "carried over" or "caught" 
by php.

Thanks for the comments on my session initialization, if there is not really
anything that should be changed, then I will leave it like it is.

Just one more thing, should I always expand the URL's to an absolute path
instead of using a session variable like I do?

Thnks again guys

Danny

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Quick session question

2010-06-24 Thread Mari Masuda

On Jun 24, 2010, at 9:09 AM, Danny wrote:

> Thanks Ashley and Jim,
> 
>> When you say 'sessions did not work' what do you mean? Sessions aren't being
>> created? You can't access session variables? You need to be a bit more 
>> specific
>> about the issue.
> 
> Sorry, here is an explanation:
> 
> The project I uploaded for a customer is a "stock ordering" web-app that they 
> used
> on their local intranet for a year or so, but now they want this same web-app 
> to
> be available globally.
> 
> I thought that it would work "out-the-box" on the internet but it doesn't. On
> their local-lan I am able to do some (advanced) login checks with sessions 
> with no
> problem, like I said, it has been workng for a year or so now. Also, the same
> login sequence I use here I also use in my other intranet web-apps.
> 
> However, when I uploaded this project and I log on, I just get a blank screen
> after the login checks are done and it is supposed to take me to the logged-in
> start page.
> 
> That is why I say that somehow my sessions are not "carried over" or "caught" 
> by php.
> 
> Thanks for the comments on my session initialization, if there is not really
> anything that should be changed, then I will leave it like it is.
> 
> Just one more thing, should I always expand the URL's to an absolute path
> instead of using a session variable like I do?
> 
> Thnks again guys
> 
> Danny
> 
> -- 
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
> 



Maybe you need to change 

$_SESSION['server'] = "http://localhost/~user/new_project"; ;

to be not localhost.
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[PHP] Making a Password Confirmation in PHP

2010-06-24 Thread Michael Calkins

This is very straight forward, if password a and b are not equal to each other, 
how can I let the user know that with out losing all of the entered information 
on the registration form?
I was trying this: 
---$p1 = "";
$p2 = "";
// if they didn't match return
$p1 = "";---
I was trying to change the value of the variable which shows the input field to 
have the password already in it.
and either one would just be echo'd depending on the result.
Any ideas please?

From,Michael calkinsmichaelcalk...@live.com

elementFontfont-familyfont-sizefont-stylefont-variantfont-weightletter-spacingline-heighttext-decorationtext-aligntext-indenttext-transformwhite-spaceword-spacingcolorBackgroundbg-attachmentbg-colorbg-imagebg-positionbg-repeatBoxwidthheightborder-topborder-rightborder-bottomborder-leftmarginpaddingmax-heightmin-heightmax-widthmin-widthoutline-coloroutline-styleoutline-widthPositioningpositiontopbottomrightleftfloatdisplayclearz-indexListlist-style-imagelist-style-typelist-style-positionTablevertical-alignborder-collapseborder-spacingcaption-sideempty-cellstable-layoutEffectstext-shadow-webkit-box-shadowborder-radiusOtheroverflowcursorvisibility
  
_
Hotmail has tools for the New Busy. Search, chat and e-mail from your inbox.
http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_1

Re: [PHP] Making a Password Confirmation in PHP

2010-06-24 Thread Ashley Sheridan
On Thu, 2010-06-24 at 11:22 -0700, Michael Calkins wrote:

> This is very straight forward, if password a and b are not equal to each 
> other, how can I let the user know that with out losing all of the entered 
> information on the registration form?
> I was trying this: 
> ---$p1 = "";
> $p2 = "";
> // if they didn't match return
> $p1 = "";---
> I was trying to change the value of the variable which shows the input field 
> to have the password already in it.
> and either one would just be echo'd depending on the result.
> Any ideas please?
> 
> From,Michael calkinsmichaelcalk...@live.com
> 
> elementFontfont-familyfont-sizefont-stylefont-variantfont-weightletter-spacingline-heighttext-decorationtext-aligntext-indenttext-transformwhite-spaceword-spacingcolorBackgroundbg-attachmentbg-colorbg-imagebg-positionbg-repeatBoxwidthheightborder-topborder-rightborder-bottomborder-leftmarginpaddingmax-heightmin-heightmax-widthmin-widthoutline-coloroutline-styleoutline-widthPositioningpositiontopbottomrightleftfloatdisplayclearz-indexListlist-style-imagelist-style-typelist-style-positionTablevertical-alignborder-collapseborder-spacingcaption-sideempty-cellstable-layoutEffectstext-shadow-webkit-box-shadowborder-radiusOtheroverflowcursorvisibility
> 
> _
> Hotmail has tools for the New Busy. Search, chat and e-mail from your inbox.
> http://www.windowslive.com/campaign/thenewbusy?ocid=PID28326::T:WLMTAGL:ON:WL:en-US:WM_HMP:042010_1


When you output the form again, output it with the values that were sent
to you (take care about deliberate injection though)

For things like select lists, I find I end up creating these from an
array in PHP anyway, so it's easy to loop through the array and set the
selected attribute if that's the value that was picked. Checkboxes and
radio buttons; if the value has been sent by the user, then mark them
checked when you output the html for them.

Don't fill password boxes, as that confuses the user. If they mistyped,
how do they know what value it holds anyway?

Thanks,
Ash
http://www.ashleysheridan.co.uk




Re: [PHP] Making a Password Confirmation in PHP

2010-06-24 Thread Floyd Resler

On Jun 24, 2010, at 2:22 PM, Michael Calkins wrote:

> 
> This is very straight forward, if password a and b are not equal to each 
> other, how can I let the user know that with out losing all of the entered 
> information on the registration form?
> I was trying this: 
> ---$p1 = "";
> $p2 = "";
> // if they didn't match return
> $p1 = "";---
> I was trying to change the value of the variable which shows the input field 
> to have the password already in it.
> and either one would just be echo'd depending on the result.
> Any ideas please?
> 
> From,Michael calkinsmichaelcalk...@live.com
> 
> 
If you aren't opposed to using JavaScript, I'd do it there.  If you don't want 
to use JavaScript then you can load the form data from the $_POST (or $_GET) 
array that was passed back to your script.

Take care,
Floyd



--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Making a Password Confirmation in PHP

2010-06-24 Thread Ashley Sheridan
On Thu, 2010-06-24 at 14:29 -0400, Floyd Resler wrote:

> On Jun 24, 2010, at 2:22 PM, Michael Calkins wrote:
> 
> > 
> > This is very straight forward, if password a and b are not equal to each 
> > other, how can I let the user know that with out losing all of the entered 
> > information on the registration form?
> > I was trying this: 
> > ---$p1 = "";
> > $p2 = "";
> > // if they didn't match return
> > $p1 = " > "\"/>";---
> > I was trying to change the value of the variable which shows the input 
> > field to have the password already in it.
> > and either one would just be echo'd depending on the result.
> > Any ideas please?
> > 
> > From,Michael calkinsmichaelcalk...@live.com
> > 
> > 
> If you aren't opposed to using JavaScript, I'd do it there.  If you don't 
> want to use JavaScript then you can load the form data from the $_POST (or 
> $_GET) array that was passed back to your script.
> 
> Take care,
> Floyd
> 
> 
> 


Is Javascript allowed to read the value of password boxes? I was of the
understanding that it couldn't, so checking if a password field matches
another is pretty moot.

Thanks,
Ash
http://www.ashleysheridan.co.uk




Re: [PHP] Quick session question

2010-06-24 Thread Gaurav Kumar
Danny,

I just read the email trail regarding your problem.

The very first thing-
1. Session are stored as a file on the server in a folder. Check that the
folder has read/*write* permission. (/tmp/ folder)
2. Check on the server that are the sessions really getting saved on the
server?
3. Now in case you do not have access to a sessions folder on the server
then set the session folder name/path to the folder (a new one) you can have
access to (may be root of your ftp) using
session_save_path('/httpdocs/'your-domain-folder/new-session-folder)
(provide read/write permission) before session_start() in index.php or
common header include file. This session_save_path() should be declared on
every file on the top.

Try the above and let me know if it works.

Thanks,
Gaurav Kumar

http://blog.OsWebStudio.Com





On Thu, Jun 24, 2010 at 7:54 PM, Danny  wrote:

> Hi guys,
>
> I always start new projects with the following session code-snippet:
> (In other words this is how I initialize my sessions in the index.php
> file.)
>
> ### START CODE SNIPPET
> 
> session_start();
>setcookie(session_name(),"",0,"/");
>unset($_COOKIE[session_name()]);
>$_SESSION = array();
>session_unset();
>session_destroy();
>
>session_start();
>
>
>/// Define some $_SESSION variables
>$_SESSION['sessionid'] = session_id() ;
>$_SESSION['server'] = 
> "http://localhost/~user/new_project"
> ;
>$_SESSION['sql_dflts'] = $_SESSION['server']."/sql/sql_dflts.inc" ;
>$_SESSION['remoteaddr'] = $_SERVER['REMOTE_ADDR'] ;
>$_SESSION['remotehost'] = gethostbyaddr ( $_SERVER['REMOTE_ADDR'] )
> ;
>
>/// Include Files
>include ( $_SESSION['sql_dflts'] ) ;
>include ( $_SESSION['server']."/fnc/fnc_include_dir.inc" ) ;
>$var_include_dir = include_dir ( "fnc" ) ;
>
> ?>
> ### END CODE SNIPPET
> #
>
> All of the projects I have done so far were for business intranet purposes
> and
> it worked fine. But last week I uploaded another project to the internet
> and my
> sessions did not work.
>
> I have been using it this way since v4.0 (I think, anyway since a LONG time
> ago), but now I think it is a bit outdated and needs some kind of revision.
> Is
> this still sufficient or can you guys give some tips on a more "updated"
> way of
> starting my sessions?
>
> My php.ini file is stock-standard. I am running version 5.2.6-1 with apache
> 2.2.9 on a Debian 5.04 machine.
>
> Thank You
>
> Danny
>
> --
> PHP General Mailing List (http://www.php.net/)
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


RE: [PHP] Making a Password Confirmation in PHP

2010-06-24 Thread David Česal
Yes, it is.

D

-Original Message-
From: Ashley Sheridan [mailto:a...@ashleysheridan.co.uk] 
Sent: Thursday, June 24, 2010 8:32 PM
To: Floyd Resler
Cc: PHP
Subject: Re: [PHP] Making a Password Confirmation in PHP

On Thu, 2010-06-24 at 14:29 -0400, Floyd Resler wrote:

> On Jun 24, 2010, at 2:22 PM, Michael Calkins wrote:
> 
> > 
> > This is very straight forward, if password a and b are not equal to each
other, how can I let the user know that with out losing all of the entered
information on the registration form?
> > I was trying this: 
> > ---$p1 = "";
> > $p2 = ""; // if they 
> > didn't match return
> > $p1 = " > "\"/>";--- I was trying to change the value of the variable which shows
the input field to have the password already in it.
> > and either one would just be echo'd depending on the result.
> > Any ideas please?
> > 
> > From,Michael calkinsmichaelcalk...@live.com
> > 
> > 
> If you aren't opposed to using JavaScript, I'd do it there.  If you don't
want to use JavaScript then you can load the form data from the $_POST (or
$_GET) array that was passed back to your script.
> 
> Take care,
> Floyd
> 
> 
> 


Is Javascript allowed to read the value of password boxes? I was of the
understanding that it couldn't, so checking if a password field matches
another is pretty moot.

Thanks,
Ash
http://www.ashleysheridan.co.uk




-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



RE: [PHP] Making a Password Confirmation in PHP

2010-06-24 Thread Ashley Sheridan
On Thu, 2010-06-24 at 20:37 +0200, David Česal wrote:

> Yes, it is.
> 
> D
> 
> -Original Message-
> From: Ashley Sheridan [mailto:a...@ashleysheridan.co.uk] 
> Sent: Thursday, June 24, 2010 8:32 PM
> To: Floyd Resler
> Cc: PHP
> Subject: Re: [PHP] Making a Password Confirmation in PHP
> 
> On Thu, 2010-06-24 at 14:29 -0400, Floyd Resler wrote:
> 
> > On Jun 24, 2010, at 2:22 PM, Michael Calkins wrote:
> > 
> > > 
> > > This is very straight forward, if password a and b are not equal to each
> other, how can I let the user know that with out losing all of the entered
> information on the registration form?
> > > I was trying this: 
> > > ---$p1 = "";
> > > $p2 = ""; // if they 
> > > didn't match return
> > > $p1 = " > > "\"/>";--- I was trying to change the value of the variable which shows
> the input field to have the password already in it.
> > > and either one would just be echo'd depending on the result.
> > > Any ideas please?
> > > 
> > > From,Michael calkinsmichaelcalk...@live.com
> > > 
> > > 
> > If you aren't opposed to using JavaScript, I'd do it there.  If you don't
> want to use JavaScript then you can load the form data from the $_POST (or
> $_GET) array that was passed back to your script.
> > 
> > Take care,
> > Floyd
> > 
> > 
> > 
> 
> 
> Is Javascript allowed to read the value of password boxes? I was of the
> understanding that it couldn't, so checking if a password field matches
> another is pretty moot.
> 
> Thanks,
> Ash
> http://www.ashleysheridan.co.uk
> 
> 
> 


Yes, so it does. That seems like a bit of a flaw in Javascript on
security grounds.

Anyway, you still need to perform the same check on the server:

  * Javascript may be turned off
  * Not every browser supports Javascript
  * Someone may make a post request without using the form


Thanks,
Ash
http://www.ashleysheridan.co.uk




Re: [PHP] Making a Password Confirmation in PHP

2010-06-24 Thread Adam Richardson
On Thu, Jun 24, 2010 at 2:46 PM, Ashley Sheridan
wrote:

> On Thu, 2010-06-24 at 20:37 +0200, David Česal wrote:
>
> > Yes, it is.
> >
> > D
> >
> > -Original Message-
> > From: Ashley Sheridan [mailto:a...@ashleysheridan.co.uk]
> > Sent: Thursday, June 24, 2010 8:32 PM
> > To: Floyd Resler
> > Cc: PHP
> > Subject: Re: [PHP] Making a Password Confirmation in PHP
> >
> > On Thu, 2010-06-24 at 14:29 -0400, Floyd Resler wrote:
> >
> > > On Jun 24, 2010, at 2:22 PM, Michael Calkins wrote:
> > >
> > > >
> > > > This is very straight forward, if password a and b are not equal to
> each
> > other, how can I let the user know that with out losing all of the
> entered
> > information on the registration form?
> > > > I was trying this:
> > > > ---$p1 = "";
> > > > $p2 = ""; // if they
> > > > didn't match return
> > > > $p1 = " > > > "\"/>";--- I was trying to change the value of the variable which
> shows
> > the input field to have the password already in it.
> > > > and either one would just be echo'd depending on the result.
> > > > Any ideas please?
> > > >
> > > > From,Michael calkinsmichaelcalk...@live.com
> > > >
> > > >
> > > If you aren't opposed to using JavaScript, I'd do it there.  If you
> don't
> > want to use JavaScript then you can load the form data from the $_POST
> (or
> > $_GET) array that was passed back to your script.
> > >
> > > Take care,
> > > Floyd
> > >
> > >
> > >
> >
> >
> > Is Javascript allowed to read the value of password boxes? I was of the
> > understanding that it couldn't, so checking if a password field matches
> > another is pretty moot.
> >
> > Thanks,
> > Ash
> > http://www.ashleysheridan.co.uk
> >
> >
> >
>
>
> Yes, so it does. That seems like a bit of a flaw in Javascript on
> security grounds.
>
> Anyway, you still need to perform the same check on the server:
>
>  * Javascript may be turned off
>  * Not every browser supports Javascript
>  * Someone may make a post request without using the form
>
>
> Thanks,
> Ash
> http://www.ashleysheridan.co.uk
>
>
>
Yes, the checks should be performed server-side, too.

In terms of security, the password field was meant merely to protect against
nearby people peering over the shoulder of the user typing in their password
(aka, shoulder surfing.)  So in terms of security, nothing is flawed, and
there has been some debate on the need and implementation of password
fields, especially given interfaces like the iphone which let you view the
last character entered for a brief amount of time:

http://www.schneier.com/blog/archives/2009/07/the_pros_and_co.html
http://www.useit.com/alertbox/passwords.html

I'd recommend progressively enhancing the page with a plugin such as those
listed below (I prefer jQuery, but there are other options for other
frameworks):

http://plugins.jquery.com/project/showPasswordCheckbox
http://plugins.jquery.com/project/fvalidate
http://plugins.jquery.com/project/iphone-password

Adam

-- 
Nephtali:  PHP web framework that functions beautifully
http://nephtaliproject.com


Re: [PHP] Quick session question

2010-06-24 Thread Jim Lucas
Danny wrote:
> Thanks Ashley and Jim,
> 
>> When you say 'sessions did not work' what do you mean? Sessions aren't being
>> created? You can't access session variables? You need to be a bit more 
>> specific
>> about the issue.
> 
> Sorry, here is an explanation:
> 
> The project I uploaded for a customer is a "stock ordering" web-app that they 
> used
> on their local intranet for a year or so, but now they want this same web-app 
> to
> be available globally.
> 
> I thought that it would work "out-the-box" on the internet but it doesn't. On
> their local-lan I am able to do some (advanced) login checks with sessions 
> with no
> problem, like I said, it has been workng for a year or so now. Also, the same
> login sequence I use here I also use in my other intranet web-apps.
> 
> However, when I uploaded this project and I log on, I just get a blank screen
> after the login checks are done and it is supposed to take me to the logged-in
> start page.

Regarding the blank page, in your php.ini file turn on display_errors and
error_reporting

error_reporting = E_ALL
display_errors = On

This will make sure that PHP tells you all the errors that are possibly being
generated.

> 
> That is why I say that somehow my sessions are not "carried over" or "caught" 
> by php.
> 
> Thanks for the comments on my session initialization, if there is not really
> anything that should be changed, then I will leave it like it is.
> 
> Just one more thing, should I always expand the URL's to an absolute path
> instead of using a session variable like I do?
> 
> Thnks again guys
> 
> Danny
> 


-- 
Jim Lucas

A: Maybe because some people are too annoyed by top-posting.
Q: Why do I not get an answer to my question(s)?
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[PHP] Unexpected behaviour from define()

2010-06-24 Thread James Long
Perhaps I am missing something basic here.

Why does the LOG_WARNING constant take on a value of 4, when
it is defined with a value of 1?

Thank you!

Jim


$ cat bug.php

$ php bug.php
LOG_NORMAL 0
LOG_WARNING 4
LOG_ERROR 2
$

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[PHP] Re: Unexpected behaviour from define()

2010-06-24 Thread James Long
On Thu, Jun 24, 2010 at 02:41:51PM -0700, James Long wrote:
> Perhaps I am missing something basic here.
> 
> Why does the LOG_WARNING constant take on a value of 4, when
> it is defined with a value of 1?
> 
> Thank you!
> 
> Jim

Answering my own question here

LOG_WARNING is already defined elsewhere it seems, by the
Network function define_syslog_variables:

$ cat bug.php

$ php bug.php
LOG_NORMAL LOG_NORMAL
LOG_WARNING 4
LOG_ERROR LOG_ERROR
$


-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Unexpected behaviour from define()

2010-06-24 Thread Tim Schofield

On 24/06/10 22:41, James Long wrote:

Perhaps I am missing something basic here.

Why does the LOG_WARNING constant take on a value of 4, when
it is defined with a value of 1?

Thank you!

Jim


$ cat bug.php

$ php bug.php
LOG_NORMAL 0
LOG_WARNING 4
LOG_ERROR 2
$



Very strange, as



seems to work fine

Tim

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Unexpected behaviour from define()

2010-06-24 Thread Ashley Sheridan
On Thu, 2010-06-24 at 23:02 +0100, Tim Schofield wrote:

> On 24/06/10 22:41, James Long wrote:
> > Perhaps I am missing something basic here.
> >
> > Why does the LOG_WARNING constant take on a value of 4, when
> > it is defined with a value of 1?
> >
> > Thank you!
> >
> > Jim
> >
> >
> > $ cat bug.php
> >  >
> > define( 'LOG_NORMAL',  0 );
> > define( 'LOG_WARNING', 1 );
> > define( 'LOG_ERROR',   2 );
> >
> > echo 'LOG_NORMAL '  . LOG_NORMAL  . "\n";
> > echo 'LOG_WARNING ' . LOG_WARNING . "\n";
> > echo 'LOG_ERROR '   . LOG_ERROR   . "\n";
> >
> > ?>
> > $ php bug.php
> > LOG_NORMAL 0
> > LOG_WARNING 4
> > LOG_ERROR 2
> > $
> >
> 
> Very strange, as
> 
>  
> define( 'LOG_NORMAL',  0 );
> define( 'LOG_WARNiNG', 1 );
> define( 'LOG_ERROR',   2 );
> 
> echo 'LOG_NORMAL '  . LOG_NORMAL  . "\n";
> echo 'LOG_WARNiNG ' . LOG_WARNiNG . "\n";
> echo 'LOG_ERROR '   . LOG_ERROR   . "\n";
> 
> ?>
> 
> seems to work fine
> 
> Tim
> 


It would, you misspelt LOG_WARNING with a lowercase 'i' ;)

Thanks,
Ash
http://www.ashleysheridan.co.uk




Re: [PHP] Unexpected behaviour from define()

2010-06-24 Thread Tim Schofield

On 24/06/10 23:08, Ashley Sheridan wrote:

On Thu, 2010-06-24 at 23:02 +0100, Tim Schofield wrote:



Very strange, as



seems to work fine

Tim



It would, you misspelt LOG_WARNING with a lowercase 'i' ;)

Thanks,
Ash
http://www.ashleysheridan.co.uk



Thats what I was trying to illustrate, it worked with lower case i but 
not with upper case, but James has explained it.


Thanks
Tim

--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Quick session question

2010-06-24 Thread Danny
Hi Gaurav,

Creating a "local" folder solved the problem. I can now catch the session
varaibles.

I think that I am too familiar with setting up everything on a local server and
forgot that there are "other" things to consider when you work on the internet.

Thank You

Danny
>On Jun 25 10, Gaurav Kumar :
> 2. Check on the server that are the sessions really getting saved on the
> server?
> 3. Now in case you do not have access to a sessions folder on the server then
> set the session folder name/path to the folder (a new one) you can have access
> to (may be root of your ftp) using session_save_path('/httpdocs/
> 'your-domain-folder/new-session-folder) (provide read/write permission) before
> session_start() in index.php or common header include file. This
> session_save_path() should be declared on every file on the top.
> 
> Try the above and let me know if it works.
> 

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Quick session question

2010-06-24 Thread Danny
Hi Jim,

I followed Gaurav's tips on creating a "folder" to store the session info in and
it got solved. I can now catch the session variables but I got A LOT of 
"include()"
file errors which was solved by following your suggestion on expanding my URL's.

Thank You

Danny

>On Jun 24 10, Jim Lucas :
> 
> Nothing looks to be wrong with the session initiation code.  The problem is 
> more
> the likely the calls to include a remote file.  Basically, to expand your
> variables out, you would be doing this:
> 
> include ( 'http://localhost/~user/new_project/sql/sql_dflts.inc' ) ;
> include ( 'http://localhost/~user/new_project/fnc/fnc_include_dir.inc' ) ;
> 
> If your php.ini settings are stock, then the problem is with the
> allow_url_include directive.  It is set to "0" by default.
> 
> See here: http://us3.php.net/manual/en/filesystem.configuration.php
> 
> Change that setting to '1' and restart your web server, then you should be 
> good
> to go.
> 

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Quick session question [SOLVED]

2010-06-24 Thread Danny
Hi Guys,

Thanks to all of you who helped me with my problem. I can now continue with my
life :) . I'm happy and the customer is happy ...

Thank you once again.

Danny

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



Re: [PHP] Quick session question

2010-06-24 Thread Danny
Hi Mari,

I used "localhost" as a substitute for the real url. My mistake I should've told
you guys. Thanks anyway for your input.

Danny
>On Jun 24 10, Mari Masuda :
> 
> Maybe you need to change 
> 
> $_SESSION['server'] = "http://localhost/~user/new_project"; ;
> 
> to be not localhost.

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php