RE: Admin Routing - The Definitive Guide?

2006-07-07 Thread Ryan Ginstrom

> [mailto:[EMAIL PROTECTED] On Behalf Of Matt
> I had a similar quandary with this as I found out you couldn't have
> sub-directories for controllers. So instead of having URLs like
> /admin/posts/add I bit the bullet and put all the actions in the admin
> controller and made the URL /admin/posts_add

If you use admin routing, /admin/posts/add will call admin_add() in your
posts_controller.php.

If you want to use other sub-directories in addition to admin, then I believe
the correct route (no pun intended) would be a plugin.

Regards,
Ryan

---
Ryan Ginstrom
[EMAIL PROTECTED] / [EMAIL PROTECTED] 
http://ginstrom.com 


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Admin Routing - The Definitive Guide?

2006-07-07 Thread Matt

I had a similar quandary with this as I found out you couldn't have
sub-directories for controllers. So instead of having URLs like
/admin/posts/add I bit the bullet and put all the actions in the admin
controller and made the URL /admin/posts_add

Not the best solution but code wise it's no different as you just have
all the actions in one controller instead of several

[EMAIL PROTECTED] wrote:
> Hi,
>
> I've been searching all things CakePHP for the last few hours and have
> hopefully found out what I need to for Admin routing e.g.
> /admin/posts/add but it was hard because of all the different advice
> e.g. CAKE_ADMIN or use routes?


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Extending SessionComponent

2006-07-07 Thread Matt

If I create my own session handler, turn it into a component and it in
its startup function set it as the default handler using
session_set_save_handler will this clash with the core
SessionComponent?

Creating my own handler / component seems the best way to achieve the
functionality I want.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: update table

2006-07-07 Thread Matt

To update a table record simply use the model's save routine and make
sure what you are saving has its id value set for example

$this->data['Post']['id'] = $post_id;
$this->Post->save($this->data);

If the controller has an id argument - eg function update($id) - you
don't have to worry about setting the id value as CakePHP does this
automatically (see thread
http://groups.google.com/group/cake-php/browse_thread/thread/d3a07c79c9975c02)


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



update table

2006-07-07 Thread Warren Chua
hi, how do you do this in cake php?UPDATE tablename SET field='$value' WHERE id = '$id'i normally use the $this->Controller->saveField('fieldname',$value);but all i get is creating a new record. is there a way? 
-- regards,wa

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---


Re: How to detect which model/controller are currently being used

2006-07-07 Thread nate

Or $this->action.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: How to detect which model/controller are currently being used

2006-07-07 Thread Myles Eftos

or $this->params['controller']

you can also find the action by

$this->params['action']

On 7/8/06, Spinnal <[EMAIL PROTECTED]> wrote:
>
> I think you can try $this->name ;)
>
>
> >
>

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: How to detect which model/controller are currently being used

2006-07-07 Thread Spinnal

I think you can try $this->name ;)


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: limiting what fields can be saved

2006-07-07 Thread nate

> Would the Security component be a solution to this problem?

Kind of, but not really.  The Security components handles access
requests at the HTTP level, and while it can detect and deflect POST
requests that don't come from within the application, it is still
possible inject form elements or spoof POST data via client-side script.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Really simple linked image: (Manual is malfunctional right now)

2006-07-07 Thread Luke

I apologize for posting before looking in the API... i discovered that
parameter about 10 seconds after I posted this question.

::blushes::


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: limiting what fields can be saved

2006-07-07 Thread brandags

Would the Security component be a solution to this problem?
http://manual.cakephp.org/chapter/18

With it, I believe you can ensure that people can't post data to your
controller from another server - so they'd have to somehow change the
html form on your own server for it to validate. I've never used it, so
I may not be understanding what it can do, but I thought I'd throw it
out there since it seems applicable.

- Brandon


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: include arbitrary content file

2006-07-07 Thread I. E. Smith-Heisters

Okay, I've got (what I think is ) a *better* solution (I'm quite proud
of this, because I'm a n00b).

I have a controller called resources_controller.php that was using
renderElement() to grab the static HTML.

1) I created a directory for the archive files, call it
/app/views/resources/files
2) I created a new route like this:
  $Route->connect('/resources/files/*', array('controller'
=> 'resources', 'action' => 'display'));
3) I copied the display() function from pages_controller.php into
resources_controller.php, and edited the line
   $this->render(join('/', $path));
to look like
   $this->render('files/'.join('/', $path));
At this point, the archive files are visible by calling
/resources/files/foo
4) Then I put this in views/resources/view.thtml
echo $this->render("files/{$location}");
$this->autoLayout = false;
where $location is something like "foo".

The result is that requests to "/resources/files/foo" show the contents
of foo.thtml, within the Cake layout, while "/resources/view/3"
includes that view, as well as any other handling done in the resources
view.thtml file.

The question I have, is that $this->autoLayout = false; is a kludgey
way of avoiding the headers rendering twice. How might I modify
ResourcesController::display() so that it returns the content as a
string without the layout if called by ResourcesController:view(), but
renders the full layout if it's called otherwise?

Thanks for the help.
-Ian


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Really simple linked image: (Manual is malfunctional right now)

2006-07-07 Thread John David Anderson (_psychic_)


On Jul 7, 2006, at 3:53 PM, Luke wrote:
> But it just displays the source code instead of the image...

$html->link() has a parameter called $escapeTitle you need to set to  
false. Be sure to check it out in the API.


-- J

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Really simple linked image: (Manual is malfunctional right now)

2006-07-07 Thread Luke

How would you make an image a link with the html helper tag? I tried
$this->html->link($this->html->image("css/images/first_arrow.gif",
htmlentities(' << ')), $page_name . '/1')

But it just displays the source code instead of the image...


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Call For CakePHP Database Driver Maintainers

2006-07-07 Thread nate

In an effort to support as many different databases as possible, we of
the CakePHP development team are putting together a team-within-a-team
of Database Driver Maintainers.

Currently, Cake fully supports 6 databases, with support on the way for
at least 4 additional databases.  Additionally, Cake has 2 other
drivers which have fallen by the wayside, and need to be updated to
support the current interfaces.

I will be putting together one team of three for each driver.  Joining
a team means you are responsible for testing all aspects of the driver,
and (optionally but preferrably) submitting patches as issues arise.
You will also be responsible for helping keep the interfaces of the
driver current with those of the Cake API.  In order to assist in this
process, I will be putting together a guide to the interfaces, and how
each of them is supposed to behave.

So if you are experienced in one of the databases listed below (or you
want to head up a new team for a driver that's not listed), send us a
signed CLA (http://cakefoundation.org/pages/cla) and respond to this
thread, and/or email me here: nate at cakephp dot org.

MySQL:
Status: up-to-date
Needs: testers, maintainers

PostgreSQL:
Status: up-to-date
Needs: testers, maintainers

MySQLi:
Status: unknown, should be mostly functional
Needs: testers, maintainers

ADOdb:
Status: Believed to be mostly up-to-date; some interfaces need
compliance-checking
Needs: testers, maintainers

MS SQL Server:
Status: 95% up-to-date, missing 2 interfaces
Needs: testers, maintainers

ODBC:
Status: Untested
Needs: developers, testers

PEAR:
Status: out-of-date
Needs: developers, testers

SQLite:
Status: up-to-date
Needs: testers, maintainers

Sybase:
Status: incomplete, untested
Needs: developers, testers

Oracle:
Status: incomplete, not interface-compliant
Needs: developers, testers

Firebird:
Status: not started
Needs: developers

PDO:
Status: not started
Needs: developers


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Sanitize

2006-07-07 Thread nate

uses( ) is a Cake-specific wrapper for require_once, that loads a
library in the core.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



How to detect which model/controller are currently being used

2006-07-07 Thread Luke

I am setting up a menu in my layout that needs to detect which
model/controller are currently being used... how would I detect this?


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Sanitize

2006-07-07 Thread Luke

is uses() a function or something? I don't understand the syntax


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



modify controller to have access to last error

2006-07-07 Thread rpetrain

Has anyone modified app_controller.php to have access to the database
connection object so you have access to the previousError?

If so can you put a snippet in here showing how you did it?

I have been trying but I am not quite there. I have access to the
object but apparently I am not using the right property or method.

Thanx.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Clarification on update/delete of HABTM models..

2006-07-07 Thread pz

Hi everyone,

I am trying out the blog example in the CakePHP manual.  I got the easy
stuff working.  Great!  However, I run into problems when I try to
update/detele HABTM models.  For example:

What's the model name for the table posts_tags?  I try PostTag, no
good.
The example shows how to save HABTM models.  Great!  But what about
update and delete??

How do I add an extra tag to a Post later?  How do I delete just one
tag from a Post later?

Right now, I have some hacking soluction with some manual query.  I am
wondering if there are cleaner codes.  Thanks.

--pz


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Updating multiple DIVs with Ajax (choosing on the server)

2006-07-07 Thread nate

Yes and no.  You can render all the div's you want, but they'll only be
sent to the client if they're included in the header that provides the
id's of the elements to be updated.

The only other thing you could do is emulate Cake's built-in mechanism
for updating multiple div's, and output everything manually.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: get error messages

2006-07-07 Thread rpetrain

It is returning false.  Once we have determined that then how do go
about getting the error message so we know what went wrong?


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Clarification on ACL

2006-07-07 Thread LetUsPrey

Yes, that is what I used for the initial setup, however, it does not
handle the multiple groups in the way I'm looking for without doing the
nested approach I mentioned above.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Bug in $html->dateTimeOptionTag

2006-07-07 Thread Spinnal

Thanks for the link Samuel, there are a lot of users in the CakePHP-es
group with the $html->dateTimeOptionTag() problem I'll share the patch
link with them.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Clarification on ACL

2006-07-07 Thread Ryan Petrain
Hi,I would get the ACM plugin and use it to set up the initial set up that you want and then look at the database so you can see the relations that are made.That might get you a better understanding of what is going on.
On 7/7/06, LetUsPrey <[EMAIL PROTECTED]> wrote:
I've finally gotten a basic auth system set up using ACL.  That hashelped me understand the thing a lot better, but there's still one partI'm a bit fuzzy on when it comes to groups.  I want to have groups (say
A, B, C, D) where a user can be a member of one, all, or anycombination of them.  Each group has access to a different section ofthe website and the access is not shared.  For example, the followingnested illustration is NOT what I am after.
A||->B ||->C  ||->DThis is, however, the only way that group access can be done in ACL,from what I've gathered from the documentation, since each ARO can onlyhave one parent.  Now this nested style could work with by created an
increasingly large number of 'groups' to handle all combinations ofgroups, but this is would be a very ugly thing to do, so I ask am Imissing something in ACL that would make the multiple groups thingpossible, or is there any way to implement what I'm looking for?

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---


Clarification on ACL

2006-07-07 Thread LetUsPrey

I've finally gotten a basic auth system set up using ACL.  That has
helped me understand the thing a lot better, but there's still one part
I'm a bit fuzzy on when it comes to groups.  I want to have groups (say
A, B, C, D) where a user can be a member of one, all, or any
combination of them.  Each group has access to a different section of
the website and the access is not shared.  For example, the following
nested illustration is NOT what I am after.

A
||->B
 ||->C
  ||->D

This is, however, the only way that group access can be done in ACL,
from what I've gathered from the documentation, since each ARO can only
have one parent.  Now this nested style could work with by created an
increasingly large number of 'groups' to handle all combinations of
groups, but this is would be a very ugly thing to do, so I ask am I
missing something in ACL that would make the multiple groups thing
possible, or is there any way to implement what I'm looking for?


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Updating multiple DIVs with Ajax (choosing on the server)

2006-07-07 Thread Gonçalo Marrafa

Hi.

Using Ajax, is there a way of choosing which divs are updated, on the
server side?

For example:

in view:

$ajax->div('one');
div one!
$ajax->divEnd('one');

$ajax->div('two');
div two!
$ajax->divEnd('two');


in controller:

function test () 
{
if (!empty($this->data) && $this->Model->save($this->data)) {
update_divs_one_and_two;
}
else {
update_only_div_one;
}
}


Can something like this be done?

Thanks in advance.

-- 
Gonçalo Marrafa <[EMAIL PROTECTED]>

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Bug in $html->dateTimeOptionTag

2006-07-07 Thread Samuel DeVore
there is a ticket with a patches at https://trac.cakephp.org/ticket/927On 7/7/06, Spinnal
 <[EMAIL PROTECTED]> wrote:I think that exists a bug in the funcion $html->dateTimeOptionTag(),
when I try to show a combo box usign this funtion and passing the valuethat I want to be selected by the function I always obtain a combo boxwithout  the date value that I pass to the funcion selected.
I think that the error is in the lines 01195 to 01197 ofcake\libs\view\helpers\html.php file.01195 if (strpos($selected, ' ') === false) {01196 $selected = '-00-00 ' .
$selected;01197 }01198 $date = explode('-', $selected);01199 $days = explode(' ', $date[2]);0120001201 $day = $days[0];
01202 $month = $date[1];01203 $year = $date[0];...The "IF" in the line 01195 always evaluates to false when we pass onlya date value, if we pass a string containting '2006-04-04 when we reach
this part of the code the "if block" change the value of my string to'-00-00 2006-04-04' after that point when we try to use theexplodes they aren´t going to work because the string is nowcorrupted.
In the cake version 1.x.x.2819 the code in the lines 01195 to 01197doesn't exist that code appears in the cake version 1.1.5.3148. If wecomment from the line 01195 to 01197 the function seems to work fine.
What do you think about this, is this a bug?Sorry about my english I'm not a native speaker..

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---


Re: limiting what fields can be saved

2006-07-07 Thread nate

I suppose we could add an option to treat the whitelist as a blacklist,
but anything beyond that and we're getting ahead of ourselves.
Handling security at this level is very application-specific.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Bug in $html->dateTimeOptionTag

2006-07-07 Thread Spinnal

I think that exists a bug in the funcion $html->dateTimeOptionTag(),
when I try to show a combo box usign this funtion and passing the value
that I want to be selected by the function I always obtain a combo box
without  the date value that I pass to the funcion selected.

I think that the error is in the lines 01195 to 01197 of
cake\libs\view\helpers\html.php file.


01195 if (strpos($selected, ' ') === false) {
01196 $selected = '-00-00 ' .
$selected;
01197 }
01198 $date = explode('-', $selected);
01199 $days = explode(' ', $date[2]);
01200
01201 $day = $days[0];
01202 $month = $date[1];
01203 $year = $date[0];
...

The "IF" in the line 01195 always evaluates to false when we pass only
a date value, if we pass a string containting '2006-04-04 when we reach
this part of the code the "if block" change the value of my string to
'-00-00 2006-04-04' after that point when we try to use the
explodes they aren´t going to work because the string is now
corrupted.

In the cake version 1.x.x.2819 the code in the lines 01195 to 01197
doesn't exist that code appears in the cake version 1.1.5.3148. If we
comment from the line 01195 to 01197 the function seems to work fine.
What do you think about this, is this a bug?

Sorry about my english I'm not a native speaker..


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: limiting what fields can be saved

2006-07-07 Thread Samuel DeVore
in your model file you could create your own save function that has a default $whitelist that then gets passed to the parent::save()Sam DOn 7/7/06, 
[EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote:
While, I feel a little less sheepish for not having noticed that ifthese guys didn't either. I'm going to have to print out the api for mybedtime reading :-)I'm still not sure I like that solution best... when my user model
contains 40-some fields, I'd rather not be passing arrays of that sizearound, when I could just blacklist the few fields I don't wantwritable... I'll be thinking about the beforeValidate and limitFieldsoptions.
Thanks for the input, guys.chris

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---


Re: limiting what fields can be saved

2006-07-07 Thread [EMAIL PROTECTED]

While, I feel a little less sheepish for not having noticed that if
these guys didn't either. I'm going to have to print out the api for my
bedtime reading :-)

I'm still not sure I like that solution best... when my user model
contains 40-some fields, I'd rather not be passing arrays of that size
around, when I could just blacklist the few fields I don't want
writable... I'll be thinking about the beforeValidate and limitFields
options.

Thanks for the input, guys.

chris


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Is there anyone who integrate CakePHP with Prado?

2006-07-07 Thread nate

> I definitely take contention of mentioning DW as lending itself to
> unreadable non-standards-compliant coding horrors.

Yes, I haven't used Dreamweaver 8, but I've heard that they've made
great strides to that effect.  My point wasn't in denigrating
Dreamweaver itself, but in using the code generated in the Dreamweaver
of yester-year for purposes of comparative imagery.

> JavaScript is probably my favourite language to program in, at the
> moment.

Could not agree more.  I actually started experimenting with haXe and
Rhinola last week.  Could you imagine using Prototype's language
enhancements on the server-side?


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: finding webroot in controller

2006-07-07 Thread francky06l

Have a look here :

http://groups.google.com/group/cake-php/browse_thread/thread/f801a4622c7395f1?hl=en


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Is there anyone who integrate CakePHP with Prado?

2006-07-07 Thread Mika

Also you could do MVC in .NET if you wanted to. Go check out the
Castle.Net project's MonoRail
(http://www.castleproject.org/index.php/MonoRail) for something similar
to ruby-on-rails and cakephp.

The fact that .NET out of the box works with a front-controller pattern
can't be held against it. They have tried to blur the line between web
and win applications in .net and they have succeeded to a point. The
state variable is there, but it does not have to be used.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Is there anyone who integrate CakePHP with Prado?

2006-07-07 Thread Jonathan Snook

nate wrote:
> Not only does this lend itself to the unreadable,
> non-standards-compliant coding horrors of other such editors (ahem,
> Dreamweaver), but it also insulates the developer from the hard
> realities of implementation which are specific to web development.  It

I definitely take contention of mentioning DW as lending itself to
unreadable non-standards-compliant coding horrors. Macromedia, er,
Adobe, has made considerable effort to have DW be a competent tool for
the standards-savvy developer. There are a number of tutorials on the
Adobe site that also educates users on how to accomplish this.

> while the page maintains state with
> a giant serialized value in a hidden field, which gets sent back to the
> server on each request.

I agree that the view state approach is silly. Store too much info and
this can get out of hand quickly.

> Now, I could go on forever about the dumb things that the .NET
> environment foists on it's developers, but I'd rather sum up with a
> code example.  Everyone knows you can send and email in PHP with one
> short, simple line of code, using the mail function.
>
> Here is one short example of doing something equivalent in .NET (notice
> how the Framework tries to be like Java with the package-style
> organization of imports):
> http://planetsourcecode.com/vb/scripts/ShowCode.asp?txtCodeId=1879&lngWId=10

Unfortunately, that's not a fair comparison. A quick email could be
done just as quickly in .NET: SmtpClient.Send("from", "to", "subject",
"body");

.NET may not be everybody's cup of tea but it's a solid language that
definitely has similarities with Java. It's just a different approach
than the one that PHP takes.

(and I'm sure we can all mention our annoyances with PHP and its
syntax. How I long for dropping $ and replacing -> with . ... and why
do half the string functions start with str and the other half with
str_)

JavaScript is probably my favourite language to program in, at the
moment.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



400 bad request when accessing http://exemple.com/cake_install without ending "/" (was Re: Help me!!!)

2006-07-07 Thread clemos

hi all

here's a message about this issue again, because it's been discussed
here already
http://groups.google.com/group/cake-php/browse_thread/thread/9f4279de30d0c6e5/e14372322a430efe
http://groups.google.com/group/cake-php/browse_thread/thread/8ebb8b8d005b7736/47cb74a831ad7b5e
but it doesn't seems to be really "solved" (at least the issue still
comes with fresh installs of Cake, which is a pity) :

a 400 bad request error is returned when accessing directly the cake
install path without ending "/" (http://example.com/cake_install) (I'm
on winXP and apache 1.3.3)

I proposed to change the root .htaccess like this :


   RewriteEngine on
   RewriteRule^$ app/webroot/[L]
   RewriteCond  %{REQUEST_FILENAME} !-d
   RewriteCond  %{REQUEST_FILENAME} !-f
   RewriteRule(.*)  app/webroot/$1 [L]


but after testing a bit, it brings some security problems, especially
you can access the "cake" directory, so I added an .htaccess like this
in "cake" :

Order Deny, Allow
Deny from all

what do you think of the solution I gave ?
why not merging it in the next version ?

++
clemos

On 7/7/06, kiterminal <[EMAIL PROTECTED]> wrote:
>
> Your solution is work.
>
> Thanks.
>
>
> >
>

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Definitive (data) pagination

2006-07-07 Thread AD7six

Hi ..

The problem is easy to diagnose, but I don't know how to solve it.

This code:
return $this->Ajax->link(
$title,
$url,
array(
"update" => $AjaxDivUpdate
),
NULL,
NULL,
FALSE
);
generates the links.

Any link returned as part of an ajax update seems to be url encoded.

This one will work
idEvent.observe('link29970050', 'click',
function(event){ new
Ajax.Updater('content','/pagination/ajaxed/?direction=DESC',
{asynchronous:true, evalScripts:true, requestHeaders:['X-Update',
'content']}) }, false);

Because there is only one get parameter, this one will not:

Sort by Category
NameEvent.observe('link1348214211',
'click', function(event){ new
Ajax.Updater('content','/pagination/ajaxed/?sortBy=name&sortByClass=Category',
{asynchronous:true, evalScripts:true, requestHeaders:['X-Update',
'content']}) }, false);

Because there are 2 get parameters and the & is being url encoded

It should be "?sortBy=name&sortByClass=Category" to work.

What needs to be done to generate the links correctly? I hope someone
more ajax savvy can show the way...

Cheers,

AD7six


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Associations between models

2006-07-07 Thread emiliano

I think that in your situation you have to set up your association as
follow:

waypoint_types hasMany waypoints
waypoint belongsTo waypoints_types

With this any waypoint will have just one type and every time could
have many waypoints.

Is this what you are looking?

hope that helps!
cheers
eemi


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: cool editors for using with cakephp

2006-07-07 Thread icelander

I use TextMate on OS X, though if the file and text navigation on Easy
Eclipse are the same or better, I might switch to that. The only thing
I don't like about TextMate is that it doesn't do code completion.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Associations between models

2006-07-07 Thread Michal Bilcik

Hello,

 I have 2 DB tables: waypoints and waypoint_types
 
 waypoints attributes:
 id,
 waypoint_type_id (FK),
 name,
 latitude,
 longtitude,
 ..
 ..
 
 waypoint_types attributes:
 id,
 name,
 description
 
 
 There is "hasOne" association between waypoint and waypoint_types models.
 But vice versa between waypoint_types and waypoint is there hasMany or 
belongsTo association?

 thanks,
 
-- 
mb


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Inner Join

2006-07-07 Thread [EMAIL PROTECTED]


Hi,

I have two tables users and comments. The user may have more than one
comments.
In user model I have given the $hasMany condition.

But while printing the output , it is taking left join . ie, it is
showing all records from users and relevant records from comments. I
want only those users who has wriiten some comments.
Also I want this to be done from User Controller ( I dont want
belongsTo from comments) and I
dont want to use custom query() method.

Any help ?

Regards
Binoy


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



paths to controllers - not just simple words

2006-07-07 Thread admataz

mmm this cake is tasting better every day. I have written a wrapper for
findAll in my app/app_controller.php  that is available to all
controllers.

this exposes the SQL options directly to the URL

http://devserver/people/findAllAvail/Person/name_first='jo'/id,name_first,name_last/name_last%20ASC

generates and returns an array according to the raw search string,
field selection and order in the url...

even better, using the path in requestAction I can do more funky stuff
with the conditions parameter, such as using something like
/name_first LIKE '%ad%'/  which works perfectly... (the browser chokes
on that one as a URL - even if you urlencode your %...)

I thought the these params had to be single word, url-safe or
variable-safe strings...

I think this is great. sorry if this is old news to everyone...

Are there any security considerations I'm being blind to? (other than
exposing the entire contents of my database if I echo these results)


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



finding webroot in controller

2006-07-07 Thread rinda

Hi,

This is my cakephp application url:
http://localhost:2999/php/uhicake/controller/action

In my controller, what variable give me this url:
http://localhost:2999/php/uhicake/ ?
WWW_ROOT give me:
http://localhost:2999/var/www/php/uhicake/app/webroot/
ROOT give me: http://localhost:2999/var/www/php/uhicake
My controller does not recognize $this->webroot

Thank you.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Help me!!!

2006-07-07 Thread kiterminal

Your solution is work.

Thanks.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



$html.php function url()

2006-07-07 Thread bibek

The problem is
$this->base gives the whole relative path instead of the first path

say
i type www.abcd.com
then the links returned will be linke
www.abcd.com/index.php/categories/add
www.abcd.com/index.php/categories/edit
www.abcd.com/index.php/items/add
...
which are fine

but say i click on www.abcd.com/index.php/categories/add
then all the links change to
www.abcd.com/index.php/categories/add/categories/add
www.abcd.com/index.php/categories/add/categories/edit
www.abcd.com/index.php/categories/add/items/add

i checked with $html.php file and found out that
$this->base gives the full relative path of the current page
in above case
$this->base gives /index.php/categories/add
which should have been
/index.php

Whats the problem?
the site works fine in my home pc but is giving problem in the actual
server

please help


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: saving data

2006-07-07 Thread Anton Bobrov
You should provide record id.

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---


saving data

2006-07-07 Thread Warren Chua
hi, how do we save a certain field on an existing record in the table without inserting new record? i use saveField( ), but all it does is generate new record.-- regards,wa

--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---


Re: limiting what fields can be saved

2006-07-07 Thread Felix Geisendörfer




Ahh you are right, it does take such a parameter. Hmm I'm beginning to
wonder why I've got this
great CakeSheet laying next to me if I don't actually look at it : p.

--
http://www.thinkingphp.org
http://www.fg-webdesign.de



Samuel DeVore schrieb:
I belive that model::save takes a third parameter of
fields to save
  
  http://api.cakephp.org/class_model.html#ef348bd6a62f8196fe42b2cebafc945f
  
  
Sam D
  
  On 7/6/06, Felix
Geisendörfer <[EMAIL PROTECTED]>
wrote:
  

Hey Chris,

I think you've got a good point there. One solution I could think of is
to do something like this:

class PostsController extends AppController
{
    var $name = 'Posts';
    
    function update()
    {
    $post = $this->__limitFields($this->data['Post'],
array('text', 'title'));
    }
    
    function __limitFields($fields, $allowed_fields)
    {
    foreach ($fields as $field => $val)
    {
    if (!in_array($field, $allowed_fields))
    {
    unset($fields[$field]);
    }
    }
    
    return $fields;
    }
}

(didn't actually try it out, but I think you get the idea.).

But still, this could leave some holes in older apps if they store
critical data in tables that can be modified like this.

Best Regards,
Felix Geisendörfer

--
http://www.thinkingphp.org
http://www.fg-webdesign.de 



Chris Renner schrieb:



  It just occurred to me that I've left a serious security hole in my 
recent cake apps. By blindly using $this->params['data'] in my save, 
I'm leaving a hole for users to change whatever fields they want to. I 

want to remind people about the potential for this, and see if the 
group has a more elegant way of solving it.

Say for example I have a User model. Users need to be able to update 
their email address, etc., but I don't want them changing, say, the 

security_level field. So far, I've just used an edit form that 
contained inputs for email address, etc. but not for security_level. 
But (having just done it), it's easy for an html-savvy user to add an 
 and change it along with 

the rest of the data. Because my controller simply contains 
$this->User->save($this->params['data']) any field that's present in 
the form will be saved, including security_level.

Now, this fix for this can be easy: in my action, unset those fields I 

don't want to be writable. But it seems like there must be better way 
to do it... based on user roles in the before_filter perhaps? Or even 
in the model? What's the philosophy here? Should controllers have 

unfettered access to all fields of a model, or should access be limited 
from the model?




  






  
  
  
  
  


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---





Re: Definitive (data) pagination

2006-07-07 Thread ..

Ajax is failing - apparently randomly (but that can't be) - will look
into it more when I have bit more time 
..


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Textmate Cake Bundle [was: cool editors for using with cakephp]

2006-07-07 Thread [EMAIL PROTECTED]

I use PhpEd by NuSpere. Its not very well known, but it deserves the
highest praises imo ! I highly recommand it. I've tried Eclipse,
Komodo, PHP Editor, but none of them did the trick for me. PhpEd did.

Its a commercial editor, but it was the only one I could find that had
all I needed : Terminal coonections directly in the interface, even for
SSH, complete documentation of PHP, HTML, CSS, etc. And Cake manual and
API docs can be directly integrated into the help system ! Of course,
colored syntax hilighting dependent on the section you're in : in a
view, if I'm in a HTML part, I'll get HTML hilighting, if I'm in a PHP
part, I'll get PHP hilighting. I know its not the only editor that does
it, but its very neat to clearly visualize the different parts (what's
not hilighted at any given moment is grayed out). The code completion
is the only one, from all the one I've tested, that's smart enough to
search included files and get function prototypes for you. PHPEd
supports PHPDoc, so the code insight even gives you info on the
function while you type it. The debugger is integrated and works very
well, there are some profiling functionnalities too, but I haven't used
them yet.

Loads of others functionnalities (Database client, Project and file
management that can use all kind of deployment channels, direct CVS and
complete integration of TortoiseSVN inside the editor's file browsers,
HTML Tidy, Code formatter HTML validator), etc.)

Man, I did write alot. Sorry 'bout that. But Its really a good editor,
so it deserves to be better known !

jtreglos


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Checked radio button

2006-07-07 Thread StinkyTofu

Thanks a lot.  It works.


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: increment a numeric field

2006-07-07 Thread bracchetto

yes.. first you read the value and then you add your number, but this
are two query,
better would be do something like "update mytable set num = num + 3
where id = 5;"
But I solved in your way thank you


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: limiting what fields can be saved

2006-07-07 Thread [EMAIL PROTECTED]

Hey Samuel,

Nice tip, that's going straight to the pool room.

Ryno


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: increment a numeric field

2006-07-07 Thread lorenzo


bracchetto ha scritto:

> how can i increment a numeric field?
$data = $myModel->read();

$myModel->set('field_to_update',$data['myModel']['field_to_update']
+1);
$myModel->save();

but i suggest you to do a function in your model class:

// In your model:

function increment() 
{
 // code here
}


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: Admin Routing - The Definitive Guide?

2006-07-07 Thread [EMAIL PROTECTED]

Hey Sam,

Thanks for your post. I'm new to this group and very very new to Cake
so thanks for helping me out.

Ryno


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---



Re: limiting what fields can be saved

2006-07-07 Thread Samuel DeVore
I belive that model::save takes a third parameter of fields to savehttp://api.cakephp.org/class_model.html#ef348bd6a62f8196fe42b2cebafc945f
Sam DOn 7/6/06, Felix Geisendörfer <[EMAIL PROTECTED]> wrote:



  
  


Hey Chris,

I think you've got a good point there. One solution I could think of is
to do something like this:

class PostsController extends AppController
{
    var $name = 'Posts';
    
    function update()
    {
    $post = $this->__limitFields($this->data['Post'],
array('text', 'title'));
    }
    
    function __limitFields($fields, $allowed_fields)
    {
    foreach ($fields as $field => $val)
    {
    if (!in_array($field, $allowed_fields))
    {
    unset($fields[$field]);
    }
    }
    
    return $fields;
    }
}

(didn't actually try it out, but I think you get the idea.).

But still, this could leave some holes in older apps if they store
critical data in tables that can be modified like this.

Best Regards,
Felix Geisendörfer

--
http://www.thinkingphp.org
http://www.fg-webdesign.de 



Chris Renner schrieb:

  It just occurred to me that I've left a serious security hole in my recent cake apps. By blindly using $this->params['data'] in my save, I'm leaving a hole for users to change whatever fields they want to. I 
want to remind people about the potential for this, and see if the group has a more elegant way of solving it.Say for example I have a User model. Users need to be able to update their email address, etc., but I don't want them changing, say, the 
security_level field. So far, I've just used an edit form that contained inputs for email address, etc. but not for security_level. But (having just done it), it's easy for an html-savvy user to add an  and change it along with 
the rest of the data. Because my controller simply contains $this->User->save($this->params['data']) any field that's present in the form will be saved, including security_level.Now, this fix for this can be easy: in my action, unset those fields I 
don't want to be writable. But it seems like there must be better way to do it... based on user roles in the before_filter perhaps? Or even in the model? What's the philosophy here? Should controllers have 
unfettered access to all fields of a model, or should access be limited from the model?  









--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake PHP" group.  To post to this group, send email to cake-php@googlegroups.com  To unsubscribe from this group, send email to [EMAIL PROTECTED]  For more options, visit this group at http://groups.google.com/group/cake-php  -~--~~~~--~~--~--~---


Re: question about the design of table's structure

2006-07-07 Thread [EMAIL PROTECTED]

>
> Not sure exactly what you mean, but I think that generally you would use a
> third table for this.
>
> As an example, take the famous blog case.
>
> We have posts and comments. Post hasMany Comment and Comment belongsTo Post.
> But Post also has an author, as does Comment.
>
> So we create User, and make:
> User hasMany Post
> Post belongsTo User
> Comment belongsTo User
>
> User
>   id
> Post
>   id
>   user_id
> Comment
>   id
>   user_id
>   post_id
>
> --
> Regards,
> Ryan Ginstrom

According to  your example:

If Post have several flelds and more than one fields need the id of
User table.
id
user_id   (the first user's id)
user_id   (another user's id)

how do it?


--~--~-~--~~~---~--~~
You received this message because you are subscribed to the Google Groups "Cake 
PHP" group.
To post to this group, send email to cake-php@googlegroups.com
To unsubscribe from this group, send email to [EMAIL PROTECTED]
For more options, visit this group at http://groups.google.com/group/cake-php
-~--~~~~--~~--~--~---