The correct places for uploaded-by-user layout file and css file

[gusnips (Gustavo)]

yes,

There’s a static method to get its alias by its ID

$this->layout=LayoutModule::getLayoutAlias($id);

what do you mean by replace ?

Reupload a file to overwrite the old one?

[perochak (Amjad Mughal)]

yes,

There’s a static method to get its alias by its ID

$this->layout=LayoutModule::getLayoutAlias($id);

what do you mean by replace ?

Reupload a file to overwrite the old one?

no no.

There might be other solution to it and that is rename of the newly uploaded theme.

But the effective solution could be achieved by storing the information into the database and instead of using its ID, its name of dir should be used.

[gusnips (Gustavo)]

Sorry for taking so long … I’m very busy lately

I didn’t have time to finish yet so I’ll post it here with the dependencies, like suggested, and you do whatever you want

Code edition not done, also the after area edit part, its only half done

feel free to ask me anything, I’m sure you will have some doubts

It will comes also with some dependencies that I use in my base application, that may be useful for you

hope you enjoy,

Cheers

EDIT: removed some more dependencies and posted under tips & tutorials here

[christiansalazarh]

Hi junxiong,

Am I missing something, or you suffer for an extreme lack of troubles and asking yourself for a really big problem? :] You want to… [b]allow your user to upload PHP file that you would then parse /b inside your own application? OMG! I wouldn’t be able to figure out a better way to ask someone to destroy your application! :]

How you would like to check if particular piece of PHP file truly contains only layout, not some dangerous code? That could not only burn your whole application but also can be a potential problem to the whole server. And I’m not talking about serious security breaches here. Simple endless loop, that will starve to death your application resources (or maybe whole server, if it is badly configured) is the first thing on a really long list of problems someone may cause, when allowed to upload and run PHP code in your website.

Not mentioning that, if server is badly secured - your PHP application will be open to use file-related functions to open some protocols and streams like HTTP. There isn’t an easier way to attack another website using code uploaded to your website, making it therefore responsible for the whole attack!

Second problem - access rights. I’m a total Linux newbie, but since PHP files are executable ones under Linux server, you have to give them (and folder you will be holding them) and execute right. Changing access rights to newly created folders is a piece of hard job in PHP (if it is allowed by server configuration) and it is also a practice that most administrators and developers wouldn’t find to good. And I can’t even imagine about idea of uploading user PHP files to protected/views folder, that is - allowing them to inject any PHP code directly into your application. That is a total madness. If you would agree on that, the only thing left to do would be to write a long, good visible message saying Hi, I’m the application ready to be destroyed - please upload any PHP code to this field. Forgive me for sarcasm! :]

Not mentioning, aesthetic problem! Badly coded CSS may make your page look like a s**t. You sure, you want it?

Are you really sure, you want to allow your users to upload own layouts? I’m trying to see this not as developer, but as regular user. Who the hell have time playing with understanding Yii’s (your’s) way of organising and implementing layouts? Who will want to play with it. Defining own layouts, themes or styles - a fixed group of fixed looks for your application - and allowing to your users to select one of closed, not user-editable of them instead of allowing to upload one - is far, far enough in my opinion.

If you really, really need to allow your users to upload own layouts, you have to design and develop your own so-called language for describing them and own engine for parsing them. Do not allow your user to upload a pure PHP code or you’re going to get yourself into a real problems!

At the end of this, probably my longest post in this forum I just want to summarise that I hope that I miss-understood you, that you don’t want to do, what I think, you want to do and that my whole talking about is just a piece of useless bulls**t! :]

Cheers,

Trejder

i build a small business application for building websites "on the air", in this application you can upload your own PHP file that simply is expected to returns a value from a well know function (public function main() { returns "code"; } ), and this value is expected to be a CSS or HTML layout…BUT…this application is used only by my small office members (very small, my wife as web page builder role, and two friends, in the same role, they create websites every day using this tool)…it resolve a lot a problems, because they can upload its own galleries or other stuff, whitout waiting for me for upload a new feature.

Well, opening this feature to public usage will be a big problem as you said, but in a controlled environment will be very usefull…

a an example, all this website is build as "virtual" (created on the air on request) : http://www.cleanandbrightservices.com and its gallery is build using a uploaded "gallery.php" always stored in a blob on the website main db record.