by
KK » Fri Dec 11, 2015 3:51 am
Hi guys
Hope you don't mind my chipping in.
I'll agree with @tim on both counts -
ugly URLs don't bother me that much. Ordinary people pay less attention to them than web designers do.
k_user_name would be better, or maybe some simple hash of the user name and/or id. My preference would be to try to obscure any personal information.
I'd like to add, though, that simply obscuring would probably won't be sufficient because if somebody tries to tamper with the obscured value, the resulting value (when we un-obscure it at our end) would likely result in invalid value.
So the requirement is two-fold -
1. the passed value is obscured
2. we can verify the integrity of this value when it comes back to us.
I did some quick-n-dirty coding to create a pair of tags that can help us in doing the above mentioned things.
Pasting the following code in 'couch/addons/kfunctions.php' file (renaming kfunctions.example.php to kfunctions.php if not found), will give us two tags -
<cms:encrypt>
<cms:decrypt>
- Code: Select all
function encrypt_handler( $params, $node ){
global $FUNCS;
if( count($node->children) ) {die("ERROR: Tag \"".$node->name."\" is a self closing tag");}
extract( $FUNCS->get_named_vars(
array(
'data'=>'',
'urlencode'=>'0',
),
$params)
);
$data = trim( $data );
$urlencode = ( $urlencode==1 ) ? 1 : 0;
$key = $FUNCS->generate_key( 32 );
$data = $FUNCS->encrypt( $data, $key );
$data = base64_encode( $data );
// concatenate with hash
$data = $data . '|' . $key;
$key = $FUNCS->hash_hmac( $data, $FUNCS->get_secret_key() );
$hash = $FUNCS->hash_hmac( $data, $key );
$data = $data . '|' . $hash;
if( $urlencode ) $data = urlencode( $data );
// return value
return $data;
}
function decrypt_handler( $params, $node ){
global $FUNCS;
if( count($node->children) ) {die("ERROR: Tag \"".$node->name."\" is a self closing tag");}
extract( $FUNCS->get_named_vars(
array(
'data'=>'',
'urldecode'=>'0',
'error_msg'=>'Invalid hash',
),
$params)
);
$data = trim( $data );
$urldecode = ( $urldecode==1 ) ? 1 : 0;
if( $urldecode ) $data = rawurldecode( $data );
$data = str_replace( ' ', '+', $data );
$error_msg = trim( $error_msg );
list( $data, $key, $hash ) = explode( '|', $data );
// verify hash to make sure data has not been tampered with
$data2 = $data . '|' . $key;
$key2 = $FUNCS->hash_hmac( $data2, $FUNCS->get_secret_key() );
$hash2 = $FUNCS->hash_hmac( $data2, $key2 );
if( $hash2 != $hash ) { ob_end_clean(); die( $error_msg ); }
$data = base64_decode( $data );
$data = $FUNCS->decrypt( $data, $key );
// return value
return $data;
}
$FUNCS->register_tag( 'encrypt', 'encrypt_handler' );
$FUNCS->register_tag( 'decrypt', 'decrypt_handler' );
A simple test for the pair could be as follows -
- Code: Select all
<cms:set my_val="<cms:encrypt 'some-secret-value' />" />
<cms:show my_val /><br/>
<cms:set my_val="<cms:decrypt my_val />" />
<cms:show my_val /><br/>
We can use the tags for securely encrypting any value we choose as the referred ID (the sample below assumes it is the k_user_id)
- Code: Select all
<cms:link masterpage=k_template_name />?referrer=<cms:encrypt k_user_id urlencode='1' />
On the return side, we can use the following code to check if a valid referral ID is provided-
- Code: Select all
<cms:set my_referrer="<cms:gpc 'referrer' method='get' />" />
<cms:if my_referrer >
<cms:set my_referrer="<cms:decrypt my_referrer error_msg='Value tampered!' />" />
... the 'my_referrer' variable at this point contains a valid untampered user ID ..
</cms:if>
In closing, I think the <cms:encrypt> and <cms:decrypt> tags can have uses beyond the particular use-case being discussed in this thread.
What are your thoughts? Would they help? Please let me know.
Would it be suitable to use DB-Forms, and Relations to link a user with his foes, registering with provided referral link?
