Recherche avancée

Sur d’autres sites (14752)

• How to verify user permissions – Introducing the Piwik Platform

  9 novembre 2014, par Thomas Steur — Development

  This is the next post of our blog series where we introduce the capabilities of the Piwik platform (our previous post was How to make your plugin multilingual). This time you’ll learn how to verify user permissions. For this tutorial you will need to have basic knowledge of PHP and the Piwik platform.

  When should a plugin verify permissions ?

  Usually you want to do this before executing any action – such as deleting or fetching data – and before rendering any sensitive information that should not be accessible by everyone. For instance in an API method or Controller action. You sometimes also need to verify permissions before registering menu items or widgets.

  How does Piwik’s user management work ?

  It is quite simple as it only differentiates between a few roles : View permission, Admin permission and Super User permission. If you manage multiple websites with Piwik a user can be assigned to different roles as a user might have no permission for some websites but view or admin permission for another set of websites.

  Worth mentioning is that roles inherit from each other. This means the role admin automatically includes the role view and a super user automatically covers the view and admin role.

  Getting started

  In this post, we assume that you have already set up your development environment and created a plugin. If not, visit the Piwik Developer Zone where you’ll find the tutorial Setting up Piwik and other Guides that help you to develop a plugin.

  Verifying user permissions

  To protect your data the platform offers many convenient methods in the \Piwik\Piwik class. There you will find methods that either start with check, is or has. While methods that start with check throw an exception in case a condition is not met, the other methods return a boolean true or false.

  Use methods that throw an exception if you want to stop any further execution in case a user does not have an appropriate role. The platform will catch the exception and display an error message or ask the user to log in.

  public function deleteAllMessages()
  {
      // delete messages only if user has super user access, otherwise show an error message
      Piwik::checkUserSuperUserAccess();
   
      $this->getModel()->deleteAllMessages();
  }
  Télécharger

  Use methods that return a boolean for instance when registering menu items or widgets.

  public function configureAdminMenu(MenuAdmin $menu)
  {
      if (Piwik::hasUserSuperUserAccess()) {
          $menu->addPlatformItem('Plugins', $this->urlForDefaultAction());
      }
  }
  Télécharger

  It is important to be aware that just because the menu item won’t be displayed in the UI a user can still open the registered URL manually. Therefore you have to check for permissions in the actual controller action as well.

  View permission

  A user having a view permission should be only able to view reports but not make any changes apart from his personal settings. The methods that end with UserHasSomeViewAccess make sure a user has at least view permission for one website whereas the methods *UserHasViewAccess($idSites = array(1,2,3)) check whether a user has view access for all of the given websites.

  Piwik::checkUserHasSomeViewAccess();
   
  Piwik::checkUserHasViewAccess($idSites = array(1,2,3));
  Télécharger

  As a plugin developer you would usually use the latter example to verify the permissions for specific websites. Use the first example in case you develop something like an “All Websites Dashboard” where you only want to make sure the user has a view permission for at least one website.

  Admin permission

  A user having an admin permission cannot only view reports but also change website related settings. The methods to check for this role are similar to the ones before, just swap the term View with Admin.

  Piwik::checkUserHasSomeAdminAccess();
   
  Piwik::checkUserHasAdminAccess($idSites = array(1,2,3));
  Télécharger

  Super user permission

  A user having the super user permission is allowed to access all of the data stored in Piwik and change any settings. To check if a user has this role use one of the methods that end with UserSuperUserAccess.

  Piwik::checkUserHasSuperUserAccess();

  As a plugin developer you would check for this permission for instance in places where your plugin shows an activity log over all users or where it offers the possibility to change any system wide settings.

  Getting information about the currently logged in user

  Sometimes you might want to know which user is currently logged in. This can be useful if you want to persist user related information in the database or if you want to send an email to the currently logged in user. You can easily get this information by calling the following methods :

  $login = Piwik::getCurrentUserLogin()
  $email = Piwik::getCurrentUserEmail()
  Télécharger

  Advanced features

  Of course there is more that you can do. For instance you can verify whether a user is an anonymous user or whether a user has a specific role. You can also perform any operation in the context of a super user even if the current user does not have this role. Would you like to know more about those features ? Check out the Piwik class reference, the Security guide and the Manage Users user guide.

  If you have any feedback regarding our APIs or our guides in the Developer Zone feel free to send it to us.

• Calling python script using a php script accessed by the browser

  16 novembre 2014, par lfalmeida

  I have a php script which will receives uploaded videos and I would like to convert these videos using ffmpeg.

  I created a python script that receives parameters from php and calls ffmpeg to do the conversion.

  index.php

  <?php
  
  
  
  $data = array('filePath' => 'video.mov');
  
  
  
  $result = shell_exec('/usr/bin/python /home/fernando/Workspace/lab1/public_html/converter.py ' . escapeshellarg(json_encode($data)));

  converter.py

  #!/usr/bin/env python
  
  
  
  import os, sys, json, subprocess, string, random
  
  
  
  class Converter():
  
  
  
  WORK_DIR = '/home/fernando/Workspace/lab1/public_html'
  
  DESTINATION_DIR = '/home/fernando/Workspace/lab1/public_html/videos/'
  
  NEW_AUDIO = 'audio.mp3'
  
  
  
  def __init__(self, data):
  
      try:
  
          os.chdir(self.WORK_DIR)
  
          self.arg = data
  
      except:
  
          print "ERROR"
  
          sys.exit(1)     
  
  
  
  
  
  def generateId():
  
      return ''.join(random.choice(string.ascii_uppercase + string.digits + string.ascii_lowercase ) for _ in range(12))      
  
  
  
  
  
  def convertVideo(self, type):
  
  
  
      convertedFileName = self.DESTINATION_DIR + self.generateId() + '.' + type
  
  
  
      typesDic = {
  
                  'mp4': ['/usr/bin/ffmpeg', '-loglevel', 'quiet', '-i', self.arg['filePath'], '-i', self.NEW_AUDIO, '-map', '0:0', '-map', '1', '-shortest', '-codec', 'copy', convertedFileName, '-y'], 
  
                  'ogv': ['/usr/bin/ffmpeg', '-loglevel', 'quiet', '-i', self.arg['filePath'], '-i', self.NEW_AUDIO, '-map', '0:0', '-map', '1', '-shortest', '-vcodec', 'libtheora', '-acodec', 'libvorbis',  convertedFileName, '-y'] 
  
                 }
  
  
  
      sp = subprocess.Popen(typesDic[type], shell=True)
  
  
  
      out, err = sp.communicate()
  
  
  
      if err:
  
          return {'status': 'error'}
  
  
  
      return {'status': 'success', 'filename': convertedFileName}
  
  
  
  
  
  
  
  
  
  data = json.loads(sys.argv[1])
  
  
  
  c = Converter(data)
  
  print c.convertVideo('mp4')
  
  print c.convertVideo('ogv')

  These codes are working the way I need, but only if I call them
   via the command line.
  Ex : $ php index.php
  ou : $ ./converter.py '{"fileName": "video.avi"}'

  If I access via browser, which was my main intention, does not work.

  I wonder what is wrong ?
  You can do this via browser ?
  Would have a better approach ?
  

  edited :
  Output from apache error log

  Use -h to get full help or, even better, run 'man ffmpeg'

  ffmpeg version 1.2.6-7:1.2.6-1 trusty1 Copyright (c) 2000-2014 the FFmpeg developers
  built on Apr 26 2014 18:52:58 with gcc 4.8 (Ubuntu 4.8.2-19ubuntu1)
  configuration : —arch=amd64 —disable-stripping —enable-avresample —enable-pthreads —enable-runtime-cpudetect —extra-version=’7:1.2.6-1 trusty1’ —libdir=/usr/lib/x86_64-linux-gnu —prefix=/usr —enable-bzlib —enable-libdc1394 —enable-libfreetype —enable-frei0r —enable-gnutls —enable-libgsm —enable-libmp3lame —enable-librtmp —enable-libopencv —enable-libopenjpeg —enable-libopus —enable-libpulse —enable-libschroedinger —enable-libspeex —enable-libtheora —enable-vaapi —enable-vdpau —enable-libvorbis —enable-libvpx —enable-zlib —enable-gpl —enable-postproc —enable-libcdio —enable-x11grab —enable-libx264 —shlibdir=/usr/lib/x86_64-linux-gnu —enable-shared —disable-static
  libavutil 52. 18.100 / 52. 18.100
  libavcodec 54. 92.100 / 54. 92.100
  libavformat 54. 63.104 / 54. 63.104
  libavdevice 53. 5.103 / 53. 5.103
  libavfilter 3. 42.103 / 3. 42.103
  libswscale 2. 2.100 / 2. 2.100
  libswresample 0. 17.102 / 0. 17.102
  libpostproc 52. 2.100 / 52. 2.100
  Hyper fast Audio and Video encoder
  usage : ffmpeg [options] [[infile options] -i infile]... [outfile options] outfile...

  Use -h to get full help or, even better, run ’man ffmpeg’
  ffmpeg version 1.2.6-7:1.2.6-1 trusty1 Copyright (c) 2000-2014 the FFmpeg developers
  built on Apr 26 2014 18:52:58 with gcc 4.8 (Ubuntu 4.8.2-19ubuntu1)
  configuration : —arch=amd64 —disable-stripping —enable-avresample —enable-pthreads —enable-runtime-cpudetect —extra-version=’7:1.2.6-1 trusty1’ —libdir=/usr/lib/x86_64-linux-gnu —prefix=/usr —enable-bzlib —enable-libdc1394 —enable-libfreetype —enable-frei0r —enable-gnutls —enable-libgsm —enable-libmp3lame —enable-librtmp —enable-libopencv —enable-libopenjpeg —enable-libopus —enable-libpulse —enable-libschroedinger —enable-libspeex —enable-libtheora —enable-vaapi —enable-vdpau —enable-libvorbis —enable-libvpx —enable-zlib —enable-gpl —enable-postproc —enable-libcdio —enable-x11grab —enable-libx264 —shlibdir=/usr/lib/x86_64-linux-gnu —enable-shared —disable-static
  libavutil 52. 18.100 / 52. 18.100
  libavcodec 54. 92.100 / 54. 92.100
  libavformat 54. 63.104 / 54. 63.104
  libavdevice 53. 5.103 / 53. 5.103
  libavfilter 3. 42.103 / 3. 42.103
  libswscale 2. 2.100 / 2. 2.100
  libswresample 0. 17.102 / 0. 17.102
  libpostproc 52. 2.100 / 52. 2.100
  Hyper fast Audio and Video encoder
  usage : ffmpeg [options] [[infile options] -i infile]... [outfile options] outfile...

  Use -h to get full help or, even better, run ’man ffmpeg’

• How to verify user permissions – Introducing the Piwik Platform

  9 novembre 2014, par Thomas Steur — Development

  This is the next post of our blog series where we introduce the capabilities of the Piwik platform (our previous post was How to make your plugin multilingual). This time you’ll learn how to verify user permissions. For this tutorial you will need to have basic knowledge of PHP and the Piwik platform.

  When should a plugin verify permissions ?

  Usually you want to do this before executing any action – such as deleting or fetching data – and before rendering any sensitive information that should not be accessible by everyone. For instance in an API method or Controller action. You sometimes also need to verify permissions before registering menu items or widgets.

  How does Piwik’s user management work ?

  It is quite simple as it only differentiates between a few roles : View permission, Admin permission and Super User permission. If you manage multiple websites with Piwik a user can be assigned to different roles as a user might have no permission for some websites but view or admin permission for another set of websites.

  Worth mentioning is that roles inherit from each other. This means the role admin automatically includes the role view and a super user automatically covers the view and admin role.

  Getting started

  In this post, we assume that you have already set up your development environment and created a plugin. If not, visit the Piwik Developer Zone where you’ll find the tutorial Setting up Piwik and other Guides that help you to develop a plugin.

  Verifying user permissions

  To protect your data the platform offers many convenient methods in the \Piwik\Piwik class. There you will find methods that either start with check, is or has. While methods that start with check throw an exception in case a condition is not met, the other methods return a boolean true or false.

  Use methods that throw an exception if you want to stop any further execution in case a user does not have an appropriate role. The platform will catch the exception and display an error message or ask the user to log in.

  public function deleteAllMessages()
  {
      // delete messages only if user has super user access, otherwise show an error message
      Piwik::checkUserSuperUserAccess();
   
      $this->getModel()->deleteAllMessages();
  }
  Télécharger

  Use methods that return a boolean for instance when registering menu items or widgets.

  public function configureAdminMenu(MenuAdmin $menu)
  {
      if (Piwik::hasUserSuperUserAccess()) {
          $menu->addPlatformItem('Plugins', $this->urlForDefaultAction());
      }
  }
  Télécharger

  It is important to be aware that just because the menu item won’t be displayed in the UI a user can still open the registered URL manually. Therefore you have to check for permissions in the actual controller action as well.

  View permission

  A user having a view permission should be only able to view reports but not make any changes apart from his personal settings. The methods that end with UserHasSomeViewAccess make sure a user has at least view permission for one website whereas the methods *UserHasViewAccess($idSites = array(1,2,3)) check whether a user has view access for all of the given websites.

  Piwik::checkUserHasSomeViewAccess();
   
  Piwik::checkUserHasViewAccess($idSites = array(1,2,3));
  Télécharger

  As a plugin developer you would usually use the latter example to verify the permissions for specific websites. Use the first example in case you develop something like an “All Websites Dashboard” where you only want to make sure the user has a view permission for at least one website.

  Admin permission

  A user having an admin permission cannot only view reports but also change website related settings. The methods to check for this role are similar to the ones before, just swap the term View with Admin.

  Piwik::checkUserHasSomeAdminAccess();
   
  Piwik::checkUserHasAdminAccess($idSites = array(1,2,3));
  Télécharger

  Super user permission

  A user having the super user permission is allowed to access all of the data stored in Piwik and change any settings. To check if a user has this role use one of the methods that end with UserSuperUserAccess.

  Piwik::checkUserHasSuperUserAccess();

  As a plugin developer you would check for this permission for instance in places where your plugin shows an activity log over all users or where it offers the possibility to change any system wide settings.

  Getting information about the currently logged in user

  Sometimes you might want to know which user is currently logged in. This can be useful if you want to persist user related information in the database or if you want to send an email to the currently logged in user. You can easily get this information by calling the following methods :

  $login = Piwik::getCurrentUserLogin()
  $email = Piwik::getCurrentUserEmail()
  Télécharger

  Advanced features

  Of course there is more that you can do. For instance you can verify whether a user is an anonymous user or whether a user has a specific role. You can also perform any operation in the context of a super user even if the current user does not have this role. Would you like to know more about those features ? Check out the Piwik class reference, the Security guide and the Manage Users user guide.

  If you have any feedback regarding our APIs or our guides in the Developer Zone feel free to send it to us.