Quote of the month
maybe this should be the quote of the year, I like it so much!
The #1, overriding concept you need to remember when writing your CGI scripts is this:
You cannot trust user input.
Go ahead -- repeat it aloud a few times. Write it down on a Post-it and stick it to your monitor. Get it tatooed on your arm.
Do not forget it. Assuming that data received from a form (even those from hidden fields) is safe is a one-way ticket to a hacked web site. Period.
Matt Riffle∞ in an article that's no longer online.

Awarded for the most impressive performance in code committing on the first day of a human being's tracked activity at CIA
Feb 27, 2007
On my Wiki / Wikka efforts
Working on a Wikka installation - for now only on my laptop Alan, as preparation for a (hopefully) community-supported user manual effort for an on-line forum system.
User accounts
My first focus is on making the process around user accounts somewhat more user-friendly as well as more secure - after all, if we
are going to have user accounts with associated rights, we should also ensure those accounts themselves are secure. I'll describe those efforts (and share results) on a
UserSettingsAndPasswords page here.
Related to
UserSettings and a few other actions, something else I encountered while working on a few user-related actions: I found there are some issues with how email addresses are handled in Wikka; an overview on
WikkaAndEmail - some code to be added later. On this page I'll also be relating to some
WikiRoles; more on this in the next paragraph.
While working on a re-write of an action, and trying to develop a "clean pattern" for it, some thoughts occurred to me about the various roles people may have with respect to a Wiki. Thinking about the roles made it easier for me to write the code (I'll explain that later); first, here are my thoughts on
WikiRoles (updated, in an attempt at clarification). Comments welcome, of course.
Calendar action
Starting with
GmBowen's
GmBowenCalendar I offered to make a "cleaned up" variant of the Calendar action for inclusion in the next (1.1.6.0) release; the result not only produces accessible table code but also has slightly extended functionality. I'm presenting it on
JwCalendar with comments.
Wikka Code Structure
I just created a page describing my proposal for a
new directory structure to organize the Wikka code.
Integration of GeSHi with Wikka
I've worked out a way to integrate GeSHi with Wikka that is very flexible: new language files can be "dropped in" without changing the code, line numbering is possible and can be enabled by a
WikiAdmin and then "turned on" for an individual code block by the end user. See
WikkaGeSHiIntegration for the details (try it for yourself!).
I've also created a little action that will automatically produce documentation about which language parser files are available for code highlighting - see
HighlighterAction for the code and screenshots of output.
Secure configuration
I've never been happy with storing the configuration file in the same directory as wikka.php where it is accessible by a web server, specfically because it contains teh credentials needed to access teh database. Besides, the current process for Wikka configuration is not only
hard to understand (and thus hard to adapt), it was also
pointed out that it currently uses GetEnv() which constitutes a security risk.
I've now written up my thoughts about a
more secure way to handle Wikka's configuration. This is not a complete solution (yet), but presents the logic we could follow to make Wikka configuration both more flexible and more secure.
New table action
Wikka doesn't have table markup - yet. Discussions about this subject are still going on, but while we haven't made a decision in which direction we want to go with this, a "preliminary" syntax might take us in the "wrong" direction if we later decide on something that's not compatible. That would not just imply extra work, but also cause needless conversions at Wikka sites.
Still, it's obvious we need something more powerful than the current simple table action, so I looked whether I could make that a bit more flexible to tide us over. The result can be found on the development page
TableAction, with documentation and examples with screen shots on
TableActionInfo. It's definitely not a perfect solution - an action won't be. It is, however backwards compatible with the current table action, so no conversions would be needed - it just can do a lot more.
More as I get to it...
From the CIA∞ ;-)
JavaWoman
- Aligning LogRefrrer() and LoadReferrers() with (just updated) version in trunk....
Commit by
JavaWoman :: r
778 /branches/1.1.6.4/libs/Wakka.class.php: (
link)
Aligning LogRefrrer() and LoadReferrers() with (just updated) version in trunk.
refs #562
- merging NOTICE fix from 1.1.6.4 [776] back to trunk
Commit by
JavaWoman :: r
777 /trunk/libs/Wakka.class.php: (
link)
merging NOTICE fix from 1.1.6.4 [776] back to trunk
- Fix for NOTICE in LogReferrer(). refs #562
Commit by
JavaWoman :: r
776 /branches/1.1.6.4/libs/Wakka.class.php: (
link)
Fix for NOTICE in LogReferrer().
refs #562
- Further changes to allow the installer to use existsPage() in the core. refs...
Commit by
JavaWoman :: r
757 /branches/1.1.6.4/ (4 files in 4 dirs): (
link)
Further changes to allow the installer to use existsPage() in the core.
refs #562
- Important change: * fix for conversion of leading spaces to tabs (did not work...
Commit by
JavaWoman :: r
756 /branches/1.1.6.4/handlers/page/edit.php: (
link)
Important change:
* fix for conversion of leading spaces to tabs (did not work at start of document); copied from online version
This change may need to be migrated to trunk; possibly some refinement possible, but at least this works.
Other changes:
* fixes for notices
* cleanup for coding guidelines
* Unix line endings
* updates in comments and docblock
- '''Wakka.class.php''' Changes to existsPage() Method: * made prefix an optional...
Commit by
JavaWoman :: r
755 /branches/1.1.6.4/ (6 files in 4 dirs): (
link)
'''Wakka.class.php'''
Changes to existsPage() Method:
* made prefix an optional parameter so the function can also be used from the installer when the configuration has not been written yet
* added an extra parameter so we can check either for any record with the give page name (original behavior), or for an active record only ('''new default''' behavior): in many cases where the function as used, checking for an active page only clearly as the intended behavior but this may cause subsequent errors if a page has been "removed" (or "hidden") while keeping page history.
* cleanup: minor changes to Action() to avoid notices
'''install.php'''
* now avoids adding extra (active) copies of a page when the installer is re-run for a new install
'''backlinks, clone and showcode handlers; usersettings action'''
* adapted to new existsPage() interface with (hopefully) the actual intended behavior - in most cases checking for an active page, not just any page record of the given name.
* some minor cleanup & docblock updates here and there
'''Note:''' Most of these changes will have to be migrated to trunk as well (at least the non-installer changes; I'm not sure about the installer).
- Changes for correct handling in installer: '''.htaccess''' * rewriting changes...
Commit by
JavaWoman :: r
754 /branches/1.1.6.4/ (.htaccess wikka.php): (
link)
Changes for correct handling in installer:
'''.htaccess'''
* rewriting changes so a correct URL is passed
'''wikka.php'''
* Check for MySQL support in PHP before starting (prevents common problems especially with first-time installs)
* based on .htaccess changes, base_url is now correctly derived, even when starting with a directory URL without trailing slash, or when given a page name but installer is triggered
Some other changes to wikka.php:
* Utility functions placed at end of file so program flow is clearer
* some general cleanup and more rational order of statements
- small fix to existsHandler() (paths are different in trunk and 1.1.6.4) (again -...
Commit by
JavaWoman :: r
749 /branches/1.1.6.4/libs/Wakka.class.php: (
link)
small fix to existsHandler() (paths are different in trunk and 1.1.6.4)
(again - it helps if you actually merge the changes...)
refs #562
- small fix to existsHandler() (paths are different in trunk and 1.1.6.4) refs...
Commit by
JavaWoman :: r
748 /branches/1.1.6.4/libs/Wakka.class.php: (
link)
small fix to existsHandler() (paths are different in trunk and 1.1.6.4)
refs #562
- minor update: name change ExistsPage -> existsPage (cf. [746]) refs #562
Commit by
JavaWoman :: r
747 /branches/1.1.6.4/ (5 files in 2 dirs): (
link)
minor update: name change ExistsPage -> existsPage (cf. [746])
refs #562
- '''New & updated functions''' * makeID (new) * FormOpen (advanced version) *...
Commit by
JavaWoman :: r
746 /branches/1.1.6.4/libs/Wakka.class.php: (
link)
'''New & updated functions'''
* makeID (new)
* FormOpen (advanced version)
* existsPage (update: name change for consistency)
* existsHandler (new)
Note: existsHandler and existsPage are moved to a new section for such "sanity checks".
refs #562
- replaced invalid 'xmp' element selector by 'samp' (there is no element 'xmp' in...
Commit by
JavaWoman :: r
739 /trunk/css/setup.css: (
link)
replaced invalid 'xmp' element selector by 'samp' (there is no element 'xmp' in HTML)
- {{{Cleanup}}} * All line endings now UNIX (a lot were still Windows/DOS or even...
Commit by
JavaWoman :: r
738 /trunk/handlers/ (21 files in 21 dirs): (
link)
{{{Cleanup}}}
* All line endings now UNIX (a lot were still Windows/DOS or even Mixed - no thanks to Eclipse)
* (where I spotted it) removed double role of # EOL comment and ticket number
* (minor) whitespace
- {{{Cleanup}}} * (where I spotted it) removed double role of # EOL comment and...
Commit by
JavaWoman :: r
737 /trunk/wikka.php: (
link)
{{{Cleanup}}}
* (where I spotted it) removed double role of # EOL comment and ticket number
* (minor) whitespace
- {{{Cleanup}}} * All line endings now UNIX (a lot were still Windows/DOS or even...
Commit by
JavaWoman :: r
736 /trunk/actions/ (41 files in 41 dirs): (
link)
{{{Cleanup}}}
* All line endings now UNIX (a lot were still Windows/DOS or even Mixed - no thanks to Eclipse)
* (where I spotted it) removed double role of # EOL comment and ticket number
* (minor) whitespace
- {{{Wakka.class.php}}} * Some changes in (advanced) FormOpen() to handle GET...
Commit by
JavaWoman :: r
735 /trunk/ (libs/Wakka.class.php css/wikka.css): (
link)
{{{Wakka.class.php}}}
* Some changes in (advanced) FormOpen() to handle GET parameters when rewrite_mode is off (to be extended later)
* minor cleanup
{{{wikka.css}}}
* added rule for class="hidden" (primarily intended for a fieldset wrapper for hidden fields, but more generally usable)
Fixes #563
- * fixes a number of notices that prevented a feed from being displayed directly...
Commit by
JavaWoman :: r
726 /trunk/handlers/ (2 files in 2 dirs): (
link)
* fixes a number of notices that prevented a feed from being displayed directly in the browser, (or as an aggregated feed via the {{rss}} action)
* some other small bugs fixed as well
* added @todo and @@@ markers in the source for further issues to be resolved (see #552 a.o); see also remarks about usage of the $item->source attribute (currently used only in an RSS 1.0 feed as a dc:source element)
* corrects @since tag in recentchanges.xml.php
refs #496,
refs #552
- small tweaks to feedback action: * improved splitting of admins list in config *...
Commit by
JavaWoman :: r
722 /trunk/actions/feedback/feedback.php: (
link)
small tweaks to feedback action:
* improved splitting of admins list in config
* retrieve admin email from DB rather than from config (DB is more likely to be current)
* suppress "manual" addition of To: header since PHP (or MTA?) adds the envelope-to also to the headers and some mail servers don't filter duplicate mails to the same address
refs #547
- fixes bug in splitting config admin users list. refs #496
Commit by
JavaWoman :: r
721 /trunk/libs/Wakka.class.php: (
link)
fixes bug in splitting config admin users list.
refs #496
- a little cleanup after changes for relocation. refs #496
Commit by
JavaWoman :: r
720 /trunk/handlers/edit/edit.php: (
link)
a little cleanup after changes for relocation.
refs #496
Links
Wikis, Groupware and OpenSource
Links to stuff that is relevant to Wikis and other online collaboration tools, and to Open Source Software development (as a process):
Just as there are licenses for Open Source, there are licences for
Open Content. Quite relevant for Wikis that actually publish content in a direct online collaboration, but I've seen several bloggers publish their content with an Open Content license as well (in fact, that's how I found out about them). There are (at least) English and German versions of such licences available. Here are a few relevant links:
Internationalization
More internationalization / Unicode links found through this presentation:
Other
Not relevant to Wikis but ...
Since Wikka has such an international community, some of you might enjoy the following column by Kevin Dolgin:
Useful Phrases∞
Meet my assistants
If you ever hang out in
#wikka you may find me talking about Alan. Or Grace, or Christiaan, or Donald now. So who the heck are they? They're my assistents, and I'd like to introduce them to you.

Grace
Grace is the matriarch of the current crew; she's aging, but patient and very capable. She serves as the command center of my little online world, with a direct ADSL Internet connection, tons of tools, and a 19" monitor that used to be nice but is slightly crippled now. Unless I'm travelling, she also handles all email and retrieves RSS feeds of a lot of sites (including this one), so I can easily follow what's happening in the world (or those aspects of the world I'm interested in). Actually, when I'm not away for long, she gets all the email by herself, and sorts it for me. She's still taking care of an external ZIP drive that she'd like to pass on to Christiaan once he gets a second parallel port. Apart from being my main assistant, she's also interested in space science, so when she has nothing to do, she makes herself useful doing calculations for
SETI@home∞ and (since a few days)
Einstein@home∞.
Update: The ZIP drive has been passed on to Albert now.

Alan
Alan - poor Alan lost his head nearly a month ago... Err, his hard disk crashed. Now that was painful. The disk was replaced within a day - but his
brains were not! Replacing all of Alan's tools and knowledge took a lot of time, but he's recovering well. A few bits still missing, but they're low priority. Somehow, while it's still unmistakably Alan, his personality changed just a bit. Actually, I think I like him better now. :) Alan is responsible for the Research and Development department, has a bunch of development tools, and also runs the development web server (Grace is too busy for that). When I'm travelling, Alan can go with me (depending on where I go, of course) and then take over email and some RSS feeds from Grace. I just replaced Alan's counterpart for my camera phone, which is why you can now see portraits of my assistants (well, I had to test that, didn't I?). Like Grace, Alan also works on
SETI@home∞ and
Einstein@home∞ when he's idle: he likes space as well, and is proud of his screen saver that shows the actual moon phases.
Update: Alan actually needed another operation after that HD crash - this time he got both his motherboard and his HD replaced. Of course it took a lot of time to get him back in working condition after such a heavy operation, but he seems a lot happier now.

Christiaan
Christiaan is the newest crew member. He had another job before (I got him 2nd hand), but here he's learning how to be a server, taking care of a bunch of peripherals. As a backup for Grace's broadband connection he has an external modem; he should be able to send faxes as well but hasn't tried that yet. He's also taking care of the printer, a flatbed scanner, and a nice CD burner. He's replacing old Albert who died a year ago - and was going to take over Albert's internal SCSI drive and external SCSI JAZ drive but it seems the SCSI card died with Albert... I'm looking for a replacement. He would like a couple of USB 2 ports as well (he only has 2 USB 1s now) so he can take care of the external 160G drive that's now attached to Alan. Well, Christiaan may not be young, but he looks healthy, and is eager to learn how to do more server work - hoping to progress to
Win2K Advanced Server soon. Christiaan of course has always loved space, and when he's not busy he helps Grace and Alan with
SETI@home∞ calculations.
Update: Christiaan just acquired an external harddisk that's going to serve as backup for all of my crew members (including Donald - see below). It took a bit of fiddling to get Christiaan to accept the new HD, but he's happy now. A while ago he also got the USB 2 ports that made this possible, as well as an extra parallel port so he could take over the ZIP drive from Grace. A new internal HD is next; no firm plans for the SCSI drives yet.
And those names?
At the point when I had more than one working computer at the same time, I started to name them. Like many other people and organizations who name their computers, there is a theme. Mine is people from science - including (of course) computer science. The oldest computer to have a name (acquired after I had him for a number of years) is Archimedes - he's probably still operational (theoretically), but I haven't booted him up for a long time. I do want him to pass some of his knowledge to the current crew members though (when I have the time to guide him through that).
Here's a complete list of my past and current "computer persons":
- Archimedes∞ - my first PC (I had a nameless Atari before that).
- Charles (Babbage)∞ - the first capable laptop I had. Limited brains (now), but he served me well when I spent many weeks in the US on an IBM project.
- Albert (Einstein)∞ - successor of Archimedes. He was fast when he was young. Died of a boot disk crash.
- Ada (Lovelace)∞ - a laptop who cooperated with Albert and later Grace; I had to leave her behind at my former employer though. :(
- Grace (Hopper)∞ - replaced Albert as my main machine, and Albert became a server. Most active member of the current crew.
- Alan (Turing)∞ - I found life without a laptop rather dull, so I got Alan to replace Ada. He's a lot more intelligent than Ada though, and seems to have a stronger personality (well, that fits).
- Christiaan (Huygens)∞ - the scientist who discovered Titan fits right in the team with Grace and Alan who were already working on SETI@home∞. Middle-aged, but still eager to learn (a bit like me, in fact :)).
A little about myself
I've been working in I(C)T since the 1980's although at present I'm unemployed. I live in Amsterdam, the Netherlands, and run a couple of websites (won't mention them all here unless you want me to). My main hobbies are
traveling∞ and photography. (You can now tell the world whether you
like my travel blog∞.)
If you google for "javawoman" you might find a little more (including sites that have nothing to do with me, of course). :)
Oh, and you may also encounter me here as
IamBack (which matches one of my domains, of course). I like having a lot of clones, so I can share out my work. ;-). Actually, I've just created this clone so I can (still) look at this site through the eyes of a non-Admin - the power of an Admin can be deceptive...
- [IRC, #wikka channel] When I'm online, I am usually present in TheLounge - the #wikka channel on irc.freenode.net - so if you have a question about Wikka, check there. Other members of the Wikka community are also regularly found there (and we're a pleasant lot - don't hesitate to ask for help, or just drop in for a chat). See TheLounge for more about our #wikka channel and where to get an IRC client if you don't have one yet.
- [IM] I also have MSN messenger and ICQ accounts; but there I accept messages only from people in my contact list; if you want to talk to me like that, give me your ID first (in #wikka, or in a comment on this page, if you prefer) so I can add you to my list.
- [Skype] And if you have Skype∞, you can
.
Backlinks
,My,Page
ACLsWithUserGroups
ActiveDirectory
AdminBadWords
AdminDevelopmentDiscussions
AdminIRC
AdminSpamLog
AdminWatchList
AdvancedFormatter
AdvancedFormOpen
AdvancedReferrersHandler
AutomaticUserPageCreation
AvaronDesign
AvaronSpecs
BaGus
Book1
CalendarActionInfo
CalendarLinkActionInfo
CategoryAvaron
CategorySystemOverhaul
CloneAction
CloneHandler
CodeContributions
CodingGuidelinesHowto
CreditsPage
DateAndTimeFormat
DescribeActions
DotMGTextSearchExpanded
DynamicPageGeneration
EditHandler
FileManagerHack
FilesAction
FilesActionHillar
FilesManagementSolution
ForeachBugInPhp4dot3dot10
FpdfIntegration
FreeLinks
GmBowen
GmBowenCalendar
GmBowenWikkaAsPIM
GraphMaker
HandlingWikkaConfig
HelpWanted
HierarchiesAndInheritance
HighlighterAction
HtmlSpecialChars
IamBack
ImprovedRecentChanges
IncludeRemote
InheritACL
InitializeSessionWorkaround
InstallingLycos
InvisibleWiki
JavaScript
JavaWoman
JenniferSalamon
JwRssTest
KeepHistory
KoG
LighttpdConfig
LinkRewriting
ListfilesAction
Mod023fCategories
Mod024fHighScores
Mod025fOwnedPages
Mod039fMindMapMod
MySkin
NewpageActionInfo
NiallB
NickK
NonObjectMemberFunction
NonWikiUserNames
OnegWRTree
OneYearOld
PageAdminAction
PageAndCategoryDivisionInACategory
PluginsInDevelopment
ProgrammingHelp
RecentChangesAction
RegisterAction
RemovingUsers
RichardBerg
RSSAutoDiscovery
SimpleMathFormula
SpreadTheWord
StayingLoggedIn
SteveB
SuggestionBox
SuggestionsArchive
TableActionInfo
TemplateSystem
TestActionNewpage
TheBrandNewPage
TheLounge
ThomasSalomon
TomSpilman
UserGroupWikkaCrew
UserMap
UserMenus
UserSettingsAndPasswords
UserSettingsPanel
ValidPageNames
WantedFormatters
WikiBreadcrumb
WikiLost
WikiPing
WikiPingDevelopment
WikiTemplate
Wikka1164Development
WikkaAccessibility
WikkaAndEmail
WikkaBetaFeatures
WikkaBugs
WikkaBugsResolved
WikkaCodeStructure
WikkaCSS
WikkaEmailToolkit
WikkaExtensibleMarkup
WikkaFolksonomy
WikkaLogicalDataModel
WikkaMenulets
WikkaOptimization
WikkaPhysicalDataModel
WikkaReleaseNotes
WikkaReleaseNotesDiscussion
WikkaSkinOptimization
WikkaSpamFighting
WikkaTables
WikkaToPDF
WikkaWithMobileDevices
XToGlorreyAtTorrey
CategoryUsers
Wikka - JavaWoman
- WikkaSites
2008-12-02 04:02:32 by VincentMayoux - added PMB
- WikiInAVacuum
2008-11-30 12:55:11 by BrianKoontz - Replace PHP code with SQL statements
- TwoColumnLayout
2008-11-30 12:22:48 by BrianKoontz - Minor updates
- VincentMayoux
2008-11-30 09:28:51 by VincentMayoux
- BrianKoontz
2008-11-30 03:26:21 by BrianKoontz
- AdamWhitlock
2008-11-26 09:25:10 by AdamWhitlock - Updated to remove the URL, since installation no longer in operation
- FredZ
2008-11-16 19:29:28 by WillyPs - fixed link
- TormodHaugen
2008-11-16 16:19:36 by TormodHaugen
- WysiWyg
2008-11-14 08:36:41 by ScouBidou
- WishListFor117
2008-11-14 04:58:25 by ScouBidou