Forum for discussing general topics related to Couch.
18 posts Page 1 of 2
Hi, @KK and Couchers.
What is the best tip to create a referral system on a couchified website? :D
I haven't spent much time thinking about it. :oops: Would it be suitable to use DB-Forms, and Relations to link a user with his foes, registering with provided referral link?
Again, a question is also on the table about generating such a link. Thank you for input :!:
@trendoman. I haven't given much thought to this either. :D But you could use custom routes with a link to your sign up form like this:
Code: Select all
<cms:link masterpage="mysignup.php" />?referrer=<cms:show k_user_id />

This would be the link a user would give to his friends. At the end of the signup process, you would use the db_persist tag to credit the referrer's account. If you need to keep track of the relationship over time, not just give credit for the initial signup, then you would use relations in the sign up process to keep track of the referral relations between users.

The k_user_id is a unique marker that doesn't change with modifications to the account. It's also anonymous enough that it's kind of subtle. If you want to anonymize it even more, you could use url cloaking to generate the link, but that gives a long, ugly link and they would still see the actual url in the browser once they arrived at the page.

Just some quick thoughts. Maybe there's something useful for you in there.
@tim :D
Nice update on this. Thank you, first of all.
However,
Code: Select all
site.com/index.php?referrer=-1
doesn't look good, does it?
k_user_id is somewhat easy to fake..
Now I think, maybe pass full email as referral id?
Code: Select all
site.com/index.php?referrer=john.doe@gmail.com

Looks rather honest. Myself, Im tired of ugly stuff in urls.
Pls, comment.. :)
k_user_id is somewhat easy to fake..
Good point.

The email address would work, but I would be very reluctant to expose a user's email address in that way. When you're in control of someone's personal information on the web, it's a big responsibility and you should guard it zealously. If John Doe posts that link on Twitter, he could be in for trouble.

I think k_user_name would be better, or maybe some simple hash of the user name and/or id. My preference would be to try to obscure any personal information.

Keep in mind that since anything about an account can change except the k_user_id, using any other piece of information could lead to referral links that don't work properly.
Code: Select all
<cms:cloak_url "<cms:link masterpage='index.php' />?referrer=<cms:show k_user_id />" />
would obscure the information, but it would also create a very long and ugly link.

Personally, ugly URLs don't bother me that much. Ordinary people pay less attention to them than web designers do. Some browsers don't even show the whole URL. But the cloak_url link still might be just too much.
@Tim,
You have the point.
I think k_user_name would be better, or maybe some simple hash of the user name and/or id. My preference would be to try to obscure any personal information.

So, employing this would probably work!
Code: Select all
<cms:random_name>

I was also told a story by @GoingMarryAsap, that sometimes a person pays to get his referral ID, in such a case it might be a hand-work stuff by admins to distribute and assign IDs. So, will leave this topic for a moment to clarify what is actually needed. I will post update here whenever I implement this or that solution :D
Thank you again.
Hi guys :)

Hope you don't mind my chipping in.

I'll agree with @tim on both counts -
ugly URLs don't bother me that much. Ordinary people pay less attention to them than web designers do.

k_user_name would be better, or maybe some simple hash of the user name and/or id. My preference would be to try to obscure any personal information.

I'd like to add, though, that simply obscuring would probably won't be sufficient because if somebody tries to tamper with the obscured value, the resulting value (when we un-obscure it at our end) would likely result in invalid value.

So the requirement is two-fold -
1. the passed value is obscured
2. we can verify the integrity of this value when it comes back to us.

I did some quick-n-dirty coding to create a pair of tags that can help us in doing the above mentioned things.

Pasting the following code in 'couch/addons/kfunctions.php' file (renaming kfunctions.example.php to kfunctions.php if not found), will give us two tags -
<cms:encrypt>
<cms:decrypt>

Code: Select all
function encrypt_handler( $params, $node ){
    global $FUNCS;

    if( count($node->children) ) {die("ERROR: Tag \"".$node->name."\" is a self closing tag");}

    extract( $FUNCS->get_named_vars(
                array(
                      'data'=>'',
                      'urlencode'=>'0',
                     ),
                $params)
    );

    $data = trim( $data );
    $urlencode = ( $urlencode==1 ) ? 1 : 0;

    $key = $FUNCS->generate_key( 32 );
    $data = $FUNCS->encrypt( $data, $key );
    $data = base64_encode( $data );

    // concatenate with hash
    $data = $data . '|' . $key;
    $key = $FUNCS->hash_hmac( $data, $FUNCS->get_secret_key() );
    $hash = $FUNCS->hash_hmac( $data, $key );
    $data = $data . '|' . $hash;
    if( $urlencode ) $data = urlencode( $data );

    // return value
    return $data;

}

function decrypt_handler( $params, $node ){
    global $FUNCS;

    if( count($node->children) ) {die("ERROR: Tag \"".$node->name."\" is a self closing tag");}

    extract( $FUNCS->get_named_vars(
                array(
                      'data'=>'',
                      'urldecode'=>'0',
                      'error_msg'=>'Invalid hash',
                     ),
                $params)
    );

    $data = trim( $data );
    $urldecode = ( $urldecode==1 ) ? 1 : 0;
    if( $urldecode ) $data = rawurldecode( $data );
    $data = str_replace( ' ', '+', $data );
    $error_msg =  trim( $error_msg );

    list( $data, $key, $hash ) = explode( '|', $data );

    // verify hash to make sure data has not been tampered with
    $data2 = $data . '|' . $key;
    $key2 = $FUNCS->hash_hmac( $data2, $FUNCS->get_secret_key() );
    $hash2 = $FUNCS->hash_hmac( $data2, $key2 );
    if( $hash2 != $hash ) { ob_end_clean(); die( $error_msg ); }

    $data = base64_decode( $data );
    $data = $FUNCS->decrypt( $data, $key );

    // return value
    return $data;

}

$FUNCS->register_tag( 'encrypt', 'encrypt_handler' );
$FUNCS->register_tag( 'decrypt', 'decrypt_handler' );

A simple test for the pair could be as follows -
Code: Select all
<cms:set my_val="<cms:encrypt 'some-secret-value' />" />
<cms:show my_val /><br/>

<cms:set my_val="<cms:decrypt my_val />" />
<cms:show my_val /><br/>

We can use the tags for securely encrypting any value we choose as the referred ID (the sample below assumes it is the k_user_id)
Code: Select all
<cms:link masterpage=k_template_name />?referrer=<cms:encrypt k_user_id urlencode='1' />

On the return side, we can use the following code to check if a valid referral ID is provided-
Code: Select all
<cms:set my_referrer="<cms:gpc 'referrer' method='get' />" />
<cms:if my_referrer >
    <cms:set my_referrer="<cms:decrypt my_referrer error_msg='Value tampered!' />" />

    ... the 'my_referrer' variable at this point contains a valid untampered user ID ..
</cms:if>

In closing, I think the <cms:encrypt> and <cms:decrypt> tags can have uses beyond the particular use-case being discussed in this thread.

What are your thoughts? Would they help? Please let me know.
eED8QDRfK2cwLAQ9ZqGBSA==|U2mxTEbvIbzrcz72IjWx5mADGbcykKk1|5cac1740ef5b1bf871bc895108452c28
:D


As to protecting personal data, can't it be so, that internet will be overloaded with nonsence like above in some not very distant future?

This is General Discussion, so I will share what i find interesting on the net. It is really exciting that there are people who also go the other way to more unobtrusive safety. Example is a real mail service, that i use here an there pretty often. You can use email to login, and nobody knows it. ;)

There is no need to have a password there. :!: If I want to give someone my mail - I give special crafted alias, which is nowhere near unreadable crypted stuff. It is a normal looking mail, which is only alias to my base mail. Simple redirect. So, why would I need a password then? Why would I bother and buy software to keep and protect passwords?

It is when a programmer doesn't have enough of broad thinking and life experience with good, thoughtful stuff, so he creates an ugly 'workable' solutions. And when a designer comes to rethink it - arise nicely done things and ways of doing things right. Thanks for listening, maybe this approach is familiar to you. :D

PS Good stuff is not for everyone, unfortunately. Coz it takes time and soul to create good user experience. When there is no such a resource available - things like passwords and fingerprints come to light. :oops:
Well, I did begin with the following premise, didn't I? -
ugly URLs don't bother me that much. Ordinary people pay less attention to them than web designers do.

Nevertheless, now when I take a look at the URL again, I realize it merits the 'The Great Predator Quote' https://www.youtube.com/watch?v=2IEFdV1frGk :lol:

That said, I do understand where you are coming from, Trendoman, but I find myself on the other side of the fence :)
Maybe we'll find use for these tags some other place.
Cool tags, @KK. But for this use, I think the cms:random_name is the best choice.
@KK, your side of fence is perfect with me. The example provided my view on some broad things. Another example of your approach can be seen throughout couch documentation, as many times we read
KK wrote: Never, ever, trust user provided inputs

Definitely, I accept it. Who wouldn't? However, my mind replaces it with some more romantic statement:
Never, ever, let user experience a glitch if she tries to input by hand and misspells, or runs a broken bookmark.

:D
18 posts Page 1 of 2