Startups & Software – Simple, Open and Pragmatic.
CakeOTP is a reference implementation of User Registration with a secure, table-less and expirable implementation of One Time Password for the popular CakePHP development framework.
JQuery is a great JavaScript framework that makes web developer life much easier. But like all framework, you need to learn its gotchas in order to work effectively with it. Here is one of those gotchas –
Jquery POST method lets you create Ajax HTTP POST request to the server. It is actually a shorthand to the JQuery Ajax method:
$.ajax({
type: "POST",url: "save.php",
data: "param1="+paramValue1
+"¶m2=paramValue2",
complete: function(){ }, //manage the complete if needed
success: function(){}}//get some data back to the screen if needed
});
Sometimes you need to enable silent (implicit) login for your users. A good example of this would be this – after a registration process, you would want to automatically login the user, rather then having him retype the user name and password.
In CakePHP there is a simple method in the Auth components that lets you login on the user’s behave.
Here is how it is done:
IPWEditor provides easy in-place editing for Web pages with a layer of WYSIWYG. It allows you to seamlessly replace text on Web pages with inputs for on-the-spot editing.
Up until now IPWEditor did not support TinyMCE advance settings, due to a minor bug found and resolved by the community.
This release incorporates this bug fix and adds additional documentation around the ‘cancel’ functionality.
I have been using CakePHP for a long time now and enjoy every second. It provides a productive, easy to use and well document platform for PHP application. The key advantages for me are – transparent OR mapping, a strong Model View Controller framework, and tons of extra utilities that make your life better.
I have came across a possible security issue in one of cakePHP code examples. This section of code is responsible to authorize or un-authorize clients access to a certain action (MVC flow)
action == 'delete') {
if ($this->Auth->user('role') == 'admin') {
return true;
} else {
return false;
}
}
return true;
}
?>
The major security rule this code is breaking is – never ever have ‘return true’ as a default for an authorization method.
You hear this all the time in software companies – Some business analysts, developer or product manager trying to solve a dilemma in software development by pushing the decision to the end user side. “Let’s make it configurable†seems like a get-out-of-jail free card if you can’t make you mind about colors, screen layout and many other hard choices we have to make many time when designing our software.
CakeOTP is a secure, table-less and expirable implementation of One Time Password for the popular CakePHP development framework.
A one-time password (OTP) is a password that is only valid for a single login session or transaction. It is commonly used in the internet for registration and password reminder process in which OTPs are provides to the user in a form of a link that the user uses to access in order to create/reset his password.
The problem is that most one-time password implementation involve maintaining additional database tables and batch process that handle the persistence and expire date of the one time password. This adds complexity and reduces performance.
CakeOTP is a simple and clean implementation of one time password. It reduces complexity by removing the redundant SQL calls and DB batch maintenance while still keeping the one time password secure and expirable.
Download this release here.
Checkout the Online Demo, project page and getting started page.
Our speaker will be James Tarquin, Enterprise Architect with Google.
He’ll be speaking about the “Key challenges with cloud services”, specifically security, change management and reliability.
Get copies of the flyer here both a thumbnail and a high-res copy are available here.
When: 2nd-Feb-2010 (Networking from 12 noon, formal session from 12:30 till 1:30pm)
Venue: Optimation Boardroom, 1 Grey Street, Wellington (New Zealand)
I have started to implement the algorithm for tableless, secure One time password.
Here is a link to the Demo, and here is a link to the beta release.
The only thing you need to do other then the regular cakePHP setup is to create a user table (used by the CakePHP Auth component):
My friends, Adrian Kearns, finally released his excellent CMS, Morphfolia, as an open source project.
Morphfolia is two things:
Morphfolia provides a suite of tools and capabilities that make website development and management flexible and easy.
This is achieved by a mature architecture and good design principles; the pages, content, page-layout and look & feel are all separated.
Content is served by HTTP Handlers, and APIs exist to support “standard” ASP.NET WebForm development so that your custom forms are consistent with the other content.
It provides (amongst other things) a built-in search engine, auto-generating site map, content indexes, web traffic monitoring, centralized system and audit logging.
Reviews / Security / web / web hosting
Hostmonster Sucks – Hostmonster Review and Warning
20 Jul, 2010
