# Security: Deny access to common configuration and data files
  # eg: .htaccess, php.ini, .user.ini, php_errors.log, php_errors.log.php, backup.sql, settings.dat.php, file.defaultSqlData.php, backup.sql, etc
  <IfModule !mod_authz_core.c>
    <FilesMatch "\.(htaccess|ini|log|dat|defaultSqlData|sql)(\.php)?$">
      Order Deny,Allow
      Deny from All
    </FilesMatch>
  </IfModule>
  <IfModule mod_authz_core.c>
    <FilesMatch "\.(htaccess|ini|log|dat|defaultSqlData|sql)(\.php)?$">
      Require all denied
    </FilesMatch>
  </IfModule>

Secure connection (ie encrypted ssl like communication between client/server) is not field, table or database it is the communication protocol between the PHP code (assuming php) and the DB driver code. On a local connection it is unlikely to be of much value as a 'hacker' would have both side of the transaction available anyway. This is more like when your web server is on one machine and the db is on another and you want secure linkage between the two. 

Field encryption is something else, and although it seems really useful the same problem occurs if the DB and code are on the same machine, if someone breaks into the server with the code they will have access to the credentials to encrypt/decrypt the data coming from the DB, otherwise it would not be usable in the application running on the web server. You would have some protection against someone who manages to access your DB or a backup held somewhere but again if it is all on one machine the protection is not all that secure.

Even using a code compiler (ie source guardian etc) is not any good as the code can be reversed.

The 'best' security is probably not available to most web host people, co-located, secured boxes with all the trimmings. If you have a reliable hosting company that does the management and you have a good vps package with **proper access restrictions the extras above are not really going to increase security.

Larry

** Access restriction meaning real passwords, no casual people accessing server, well crufted code etc

What's up doc?
Larry

$row['content'] = Cleanup::makeUTF8( $row['content'] );

The page is set to UTF8, but not showing the stuff correctly obviously I have something setup wrong but I simply can not find it. Oh well hammer it to compliance.

:-)

Any suggestions?

The problem (I think) with what you want is that the category is not necessarily set when the upload code is called. The actual file name is not really an issue if you are showing them on the site or am I missing something?

DefaultUploadStorageStrategy::storeMainFile() has $fieldSchema so the call to _saveUpload_chooseUniqueNumberedFilename() needs to add it and the hook call also needs to add it ... that should not cause any old hook issues.

Is this possible ... as my check is for tableName == 'blog'and fieldname == 'gallery' (as an example)

Thanks!

What I am about to try changed upload_functions.php line 295

// move main upload to long-term storage
$GLOBALS['fieldname'] = $fieldname;
upload_storage_strategy()->storeMainFile($mainUploadWorkingPath, $uploadInfo['name'], $fieldSchema, $uploadRecordDetails);
unset($GLOBALS['fieldname']);


OK that works for saving the filePath but the change is NOT made to the urlPath the base name is there so all of the file links fail ;-)

Just had a look ... no schema passed so can not process per field/table

So a a general thing the upload path allows you to put /my/main/path/{yyyy}/{mm} (or whatever) the url path would still be /my/main/path as the y/m is added to the file name in the uploads table. This is similar to what wordpress does for its uploads.

FWIW ... having more than a few hundred files in a single directory is a bad idea ;-)

Don't want to do it as a plugin just want to add some code, did I miss something or should I ask for a custom.php to be loaded by the init process.

Thanks
Larry

OK in the defined prefix what I would like is the ability for some common 'substitutions' like;

• blog/{YYYY}/{MM}  -- which would blat out as blog/2017/11/

Date is the only one I want but if it were done with an event call made anything wanted could be added.

Cheers
Larry

Anyway, I suppose when all the whinging and whining is removed it is that CMSB really needs to be api driven, so all the internals use the same api we can then also use in our front end stuff. I do not know if I am unique but I love using CMSB but only as the back end manager for content management all of the user side of the system I use a different method (ie templates, lazy loading classes et al) you may think it aint doable that's ok I will continue with adding stuff to my cmsb class as I need them :-)

Larry

PS: It is just the thumbnail code is painful as it is in three different files that I need to work out what you are doing so I can duplicate it ... which is why I suggest api, if I add an upload I should be able to call something like cmsbAPI::buildThumb( recnum_of_the_upload );

1. Uploads ... I have the code to do the upload, move the file, create the record in cmsb_uploads but how can I easily without having to load all of cmsb generate the thumbs?
2. Meta ... same thingy, I don't use cmsb on the front end it is PDO driven, need a simple method for loading cmsb meta information, I already do some of my own for the display system like Carbon date diff for hoomans
3. API .. what would be useful is a way for an application to jag into cmsb for stuff, my site load is really fast because everything lazy loads only when needed I don't want to load all of cmsb when all I want is front end stuff, there just doesn't seem to be a front end interface apart from the viewer functions loader.

Thanks,
Larry

This...

$permalinkRecord = mysql_get('_permalinks', null, array('permalink' => $link)); // check if permalink already exists in database
$isAlreadyUsed   = $permalinkRecord && $permalinkRecord['recordNum'] != $num;


Should be

$permalinkRecord = mysql_get('_permalinks', null, array('permalink' => $link)); // check if permalink already exists in database
$isAlreadyUsed   = $permalinkRecord && $table != $permalinkRecord['tableName'] && $permalinkRecord['recordNum'] != $num;


Larry

Larry

Larry

Larry