Merge lp:~henrik-lochmann/goobi-presentation/bug-985487 into lp:goobi-presentation/1.1

[Henrik Lochmann]

Implementation of feature/wishlist bug #985487.

[Sebastian Meyer (sebastian-meyer)]

Great work, but there are some more things to do:

- Please add t3jquery to the dependencies in ext_emconf.php.

- Check for the extension to be loaded und use its API to integrate the libraries.
  (see http://typo3.org/extension-manuals/t3jquery/2.2.0/view/1/5/)

- I suggest moving the getSolrSuggestUrl() method from tx_dlf_search_suggest to tx_dlf_solr. Also it should respect username and password if necessary (see solrConnect() in tx_dlf_solr) and handle the core correctly (currently the core isn't regarded at all although there is a variable named $core).

- According to the Coding Guidelines tx_dlf_search_suggest should be a child of tx_dlf_plugin instead of tslib_pibase.

- Please make all private methods protected in order to allow proper class inheritage.

Thanks! :o)

review: Needs Fixing

[Henrik Lochmann (henrik-lochmann)]

> Great work, but there are some more things to do:
>
> - Please add t3jquery to the dependencies in ext_emconf.php.
Ok.

> - Check for the extension to be loaded und use its API to integrate the
> libraries.
> (see http://typo3.org/extension-manuals/t3jquery/2.2.0/view/1/5/)
Ok.

> - I suggest moving the getSolrSuggestUrl() method from tx_dlf_search_suggest
> to tx_dlf_solr. Also it should respect username and password if necessary (see
> solrConnect() in tx_dlf_solr) and handle the core correctly (currently the
> core isn't regarded at all although there is a variable named $core).
Ok, see below.

> - According to the Coding Guidelines tx_dlf_search_suggest should be a child
> of tx_dlf_plugin instead of tslib_pibase.
The class tx_dlf_search_suggest works as eID-based Ajax backend for search suggestion requests. The eID mechanism of Typo3 allows to bypass Typo3 frontend rendering routines, which speeds communication massively up. Thus, the class tx_dlf_search_suggest is not part of and does not have access to frontend functionality, which is necessary for tx_dlf_plugin. Therefore, it currently does not inherit from tx_dlf_plugin as demanded by the coding guidelines.

Unfortunately, at least proper Solr core handling requires frontend access, because the core is adjusted in the corresponding frontend plugin instance of the rendered page. In order to avoid the instantiation of the frontend only to read the configured Solr core, I propose to render a hidden field, as part of the search form, that contains the atcual Solr core value.

> - Please make all private methods protected in order to allow proper class
> inheritage.
Ok.

review: Needs Information

[Sebastian Meyer (sebastian-meyer)]

Rendering a hidden field for the Solr core number in the search form could be a security issue, because the field's value can be manipulated and thus a user could query any Solr core.

Although I admit that initializing the whole TSFE object in tx_dlf_search_suggest creates a lot of overhead, I would nevertheless propose doing something like this:

http://www.zoe.vc/2008/typoscript-auslesen/

That way you could read the plugin's configuration and get the Solr core number without ignoring the proper access conditions.

review: Needs Fixing

[Henrik Lochmann (henrik-lochmann)]

I'm seriously concerned about the performance loss, coming with the instantiation of the t3 frontend for every single letter typed in the search field.

What if we encrypt the hidden field in a way that ensures its value is 1) unreadable for the user and 2) definitely unchanged when comes back to the server? For instance, Yavor Atanasov proposed a solution which seems pretty strong:

- http://yavkata.co.uk/weblog/php/securing-html-hidden-input-fields-using-encryption-and-hashing/

review: Needs Information

[lp:~henrik-lochmann/goobi-presentation/bug-985487]

81. By Henrik Lochmann on 2012-06-04

- fixed review todos

[Sebastian Meyer (sebastian-meyer)]

This should be merged into goobi-presentation/1.1, so I deleted the merge proposal for goobi-presentation/1.2 and moved the proposal's text here:

Henrik Lochmann wrote:

Unfortunately, my local commit messages obviously did not reach LP. Thus, here at least a textual summary of the changes:

- dlf/ext_emconf.php: dependency to t3jquery
- dlf/ext_autoload.php: loads tx_dlf_search_suggest
- dlf/common/class.tx_dlf_solr.php: getSolrUrl() respects solr core

- dlf/plugins/search/*
+ t3jquery dependencies are properly included when using search suggestions
+ search form, suggestions and search template work on secured hidden input that contains the index name of the incorporated solr core (this code only works when PHP mcrypt extension is installed, otherwise nothing happens)

=== modified file 'dlf/common/class.tx_dlf_solr.php'
--- dlf/common/class.tx_dlf_solr.php	2012-03-30 09:14:14 +0000
+++ dlf/common/class.tx_dlf_solr.php	2012-06-04 15:53:22 +0000
@@ -29,7 +29,7 @@
 /**
  * Solr class 'tx_dlf_solr' for the 'dlf' extension.
  *
- * @author	Sebastian Meyer <[e-mail]>
+ * @author	Sebastian Meyer <[e-mail]>, Henrik Lochmann <[e-mail]>
  * @copyright	Copyright (c) 2011, Sebastian Meyer, SLUB Dresden
  * @package	TYPO3
  * @subpackage	tx_dlf
@@ -46,6 +46,35 @@
 	public static $extKey = 'dlf';
 
 	/**
+	 * Returns the request url for Solr-based search suggestions.
+	 *
+	 * @access	public
+	 *
+	 * @return	string		The request url for Solr-based search suggestions.
+	 */
+	public static function getSolrUrl($core) {
+		// Extract extension configuration.
+		$conf = unserialize($GLOBALS['TYPO3_CONF_VARS']['EXT']['extConf'][tx_dlf_solr::$extKey]);
+		
+		// Derive Solr host name.
+		$host = ($conf['solrHost'] ? $conf['solrHost'] : 'localhost');
+		
+		// Prepend username and password to hostname.
+		if ($conf['solrUser'] && $conf['solrPass']) {
+			$host = $conf['solrUser'].':'.$conf['solrPass'].'@'.$host;
+		}
+		
+		// Set port if not set.
+		$port = t3lib_div::intInRange($conf['solrPort'], 1, 65535, 8180);
+
+		// Append core name to path.
+		$path = trim($conf['solrPath'], '/').'/'.$core;
+		
+		// Return entire request url.
+		return 'http://'.$host.':'.$port.'/'.$path;
+	}
+	
+	/**
 	 * Get SolrPhpClient service object and establish connection to Solr server
 	 * @see EXT:dlf/lib/SolrPhpClient/Apache/Solr/Service.php
 	 *

=== modified file 'dlf/ext_autoload.php'
--- dlf/ext_autoload.php	2012-04-30 16:05:21 +0000
+++ dlf/ext_autoload.php	2012-06-04 15:53:22 +0000
@@ -49,6 +49,7 @@
 	'tx_dlf_oai' => $extensionPath.'plugins/oai/class.tx_dlf_oai.php',
 	'tx_dlf_pageview' => $extensionPath.'plugins/pageview/class.tx_dlf_pageview.php',
 	'tx_dlf_search' => $extensionPath.'plugins/search/class.tx_dlf_search.php',
+	'tx_dlf_search_suggest' => $extensionPath.'plugins/search/class.tx_dlf_search_suggest.php',
 	'tx_dlf_statistics' => $extensionPath.'plugins/statistics/class.tx_dlf_statistics.php',
 	'tx_dlf_toc' => $extensionPath.'plugins/toc/class.tx_dlf_toc.php',
 	'tx_dlf_toolbox' => $extensionPath.'plugins/toolbox/class.tx_dlf_toolbox.php',

=== modified file 'dlf/ext_emconf.php'
--- dlf/ext_emconf.php	2012-05-15 08:01:44 +0000
+++ dlf/ext_emconf.php	2012-06-04 15:53:22 +0000
@@ -44,6 +44,7 @@
 		'depends' => array(
 			'php' => '5.3.0-',
 			'typo3' => '4.3.0-',
+			't3jquery' => '2.1.2-',
 		),
 		'conflicts' => array(
 		),

=== modified file 'dlf/ext_localconf.php'
--- dlf/ext_localconf.php	2012-05-08 07:41:38 +0000
+++ dlf/ext_localconf.php	2012-06-04 15:53:22 +0000
@@ -66,4 +66,6 @@
 // Register command line scripts.
 $GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['GLOBAL']['cliKeys'][$_EXTKEY] = array ('EXT:'.$_EXTKEY.'/cli/class.tx_dlf_cli.php', '_CLI_dlf');
 
+// Register solr suggest eID.
+$GLOBALS['TYPO3_CONF_VARS']['FE']['eID_include']['tx_dlf_suggest'] = 'EXT:'.$_EXTKEY.'/plugins/search/class.tx_dlf_search_suggest.php';
 ?>
\ No newline at end of file

=== modified file 'dlf/plugins/search/class.tx_dlf_search.php'
--- dlf/plugins/search/class.tx_dlf_search.php	2012-05-05 11:10:37 +0000
+++ dlf/plugins/search/class.tx_dlf_search.php	2012-06-04 15:53:22 +0000
@@ -29,7 +29,7 @@
 /**
  * Plugin 'DLF: Search' for the 'dlf' extension.
  *
- * @author	Sebastian Meyer <[e-mail]>
+ * @author	Sebastian Meyer <[e-mail]>, Henrik Lochmann <[e-mail]>
  * @copyright	Copyright (c) 2011, Sebastian Meyer, SLUB Dresden
  * @package	TYPO3
  * @subpackage	tx_dlf
@@ -39,6 +39,103 @@
 
 	public $scriptRelPath = 'plugins/search/class.tx_dlf_search.php';
 
+	/**
+	 * Adds the HTML content for two hidden input fields, namely 'encrypted' and 'hashed', containing 
+	 * the index_name if the passed solrCore number, to the passed marker arrays value
+	 * '###ADDITIONAL_INPUTS###'. This is necessary to savely render search suggestions.
+	 *
+	 * @access	protected
+	 *
+	 * @return	array
+	 */
+	protected function addEncryptedSolrCore($markerArray, $solrCore) {
+	
+		// Extract internal dlf core name.
+		$table = 'tx_dlf_solrcores';
+		
+		$_result = $GLOBALS['TYPO3_DB']->exec_SELECTquery(
+				$table.'.index_name AS index_name',
+				$table,
+				$table.'.uid='.$solrCore.tx_dlf_helper::whereClause($table),
+				'',
+				'',
+				'1'
+		);
+		
+		$dlfCoreName = '';
+		
+		if ($GLOBALS['TYPO3_DB']->sql_num_rows($_result) > 0) {
+		
+			$resArray = $GLOBALS['TYPO3_DB']->sql_fetch_assoc($_result);
+		
+			$dlfCoreName = $resArray['index_name'];
+		
+		}
+		
+		if (empty($dlfCoreName)) {
+			
+			trigger_error('Failed to query for internal solr core name of core number '.$solrCore, E_USER_NOTICE);
+			
+			return;
+			
+		}
+
+		$encryptedCore = tx_dlf_search_suggest::encrypt($dlfCoreName);
+
+		if (empty($encryptedCore)) {
+			
+			$markerArray['###ADDITIONAL_INPUTS###'] = '';
+
+		} else {
+			
+			$markerArray['###ADDITIONAL_INPUTS###'] = '<input type="hidden" name="encrypted" value="'.$encryptedCore['value'].'"/>'
+				.'<input type="hidden" name="hashed" value="'.$encryptedCore['hash'].'"/>';
+			
+		}
+	
+		return $markerArray;
+
+	}
+
+	/**
+	 * Adds the JS files necessary for search sugestions to the
+	 * page header.
+	 *
+	 * @access	protected
+	 *
+	 * @return	void
+	 */
+	protected function addSuggestSupport() {
+		// ensure jquery is loaded
+		if (t3lib_extMgm::isLoaded('t3jquery')) {
+			require_once(t3lib_extMgm::extPath('t3jquery').'class.tx_t3jquery.php');
+		}
+	
+		// if t3jquery is loaded and the custom Library had been created
+		if (T3JQUERY === true) {
+			tx_t3jquery::addJqJS();
+		} else {
+			/*
+			 * suggestions will not work; we don't indicate an no error
+			* because this is caused by insufficient configuration and
+			* this feature does not harm the rest of the framework's
+			* functionality
+			*/
+			return;
+		}
+	
+		$libs = array(
+				"search_suggest" => "search_suggest.js"
+		);
+	
+		foreach ($libs as $lib_key => $lib_file) {
+			$GLOBALS['TSFE']->additionalHeaderData[$this->prefixId.$lib_key] = '	<script type="text/javascript" src="'
+			.t3lib_extMgm::siteRelPath($this->extKey)
+			.'plugins/search/'.$lib_file
+			.'"></script>';
+		}
+	}
+
 	/**
 	 * The main method of the PlugIn
 	 *
@@ -58,15 +155,18 @@
 
 		// Quit without doing anything if required variables are not set.
 		if (empty($this->conf['solrcore'])) {
-
+		
 			trigger_error('Incomplete configuration for plugin '.get_class($this), E_USER_NOTICE);
 
 			return $content;
 
 		}
-
+		
 		if (empty($this->piVars['query'])) {
-
+			
+			// Add suggest JavaScript file.
+			$this->addSuggestSupport();
+			
 			// Load template file.
 			if (!empty($this->conf['templateFile'])) {
 
@@ -97,7 +197,10 @@
 				'###FIELD_QUERY###' => $this->prefixId.'[query]',
 				'###QUERY###' => htmlspecialchars($lastQuery),
 			);
-
+			
+			// Encrypt solr core name and add as hidden input field to marker array to enable for search suggestions.
+			$markerArray = $this->addEncryptedSolrCore($markerArray, $this->conf['solrcore']);
+			
 			// Display search form.
 			$content .= $this->cObj->substituteMarkerArray($this->template, $markerArray);
 

=== added file 'dlf/plugins/search/class.tx_dlf_search_suggest.php'
--- dlf/plugins/search/class.tx_dlf_search_suggest.php	1970-01-01 00:00:00 +0000
+++ dlf/plugins/search/class.tx_dlf_search_suggest.php	2012-06-04 15:53:22 +0000
@@ -0,0 +1,140 @@
+<?php
+/***************************************************************
+ *  Copyright notice
+ *
+ *  (c) 2012 Henrik Lochmann <[e-mail]>
+ *  All rights reserved
+ *
+ *  This script is part of the TYPO3 project. The TYPO3 project is
+ *  free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  The GNU General Public License can be found at
+ *  http://www.gnu.org/copyleft/gpl.html.
+ *
+ *  This script is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  This copyright notice MUST APPEAR in all copies of the script!
+ ***************************************************************/
+
+/**
+ * Search suggestion Ajax backend for the Plugin 'DLF: Search' of the
+ * 'dlf' extension. This class is invoked using the eID bypass.
+ *
+ * @author	Henrik Lochmann <[e-mail]>
+ * @copyright	Copyright (c) 2012, Zeutschel GmbH
+ * @package	TYPO3
+ * @subpackage	tx_dlf
+ * @access	public
+ */
+require_once (PATH_tslib . 'class.tslib_pibase.php');
+class tx_dlf_search_suggest extends tslib_pibase {
+
+	private $content;
+
+	private static $ENCRYPTION_KEY = 'b8b311560d3e6f8dea0aa445995b1b2b';
+	
+	private static $ENCRYPTION_IV = '381416de30a5c970f8f486aa6d5cc932';
+
+	public $scriptRelPath = 'plugins/search/class.tx_dlf_search_suggest.php';
+
+	public static function encrypt($original_value) {
+		
+		if (!extension_loaded('mcrypt')) {
+		
+			trigger_error('Mycrpt PHP extension not installed, falling back to TSFE instantiation for '.get_class(), E_USER_NOTICE);
+			
+			return NULL;
+		
+		}
+		
+		$iv = substr( self::$ENCRYPTION_IV, 0, mcrypt_get_iv_size(MCRYPT_BLOWFISH, MCRYPT_MODE_CFB) );
+		
+		$encryptedValue = base64_encode( mcrypt_encrypt(MCRYPT_BLOWFISH, self::$ENCRYPTION_KEY, $original_value, MCRYPT_MODE_CFB, $iv) );
+		
+		$salt = substr( md5(uniqid(rand(), true)), 0, 10 );
+		
+		$hash = $salt . substr(sha1($salt . $original_value),-10);
+		
+		return array( 'value' => $encryptedValue, 'hash' => $hash);
+
+	}
+
+	public static function decrypt($encrypted, $hash) {
+		
+		if (!extension_loaded('mcrypt')) {
+			
+			trigger_error('Mycrpt PHP extension not installed, falling back to TSFE instantiation for '.get_class(), E_USER_NOTICE);
+			
+			return NULL;
+		
+		}
+		
+		if (empty($encrypted) || empty($hash)) {
+
+			return NULL;
+
+		}
+		
+		$result = NULL;
+
+		$iv = substr(self::$ENCRYPTION_IV, 0, mcrypt_get_iv_size(MCRYPT_BLOWFISH, MCRYPT_MODE_CFB));
+		
+		$decrypted_value = mcrypt_decrypt(MCRYPT_BLOWFISH, self::$ENCRYPTION_KEY, base64_decode($encrypted), MCRYPT_MODE_CFB, $iv);
+
+		$salt = substr($hash, 0, 10);
+
+		$new_hashed_value = $salt . substr(sha1($salt . $decrypted_value), -10);
+
+		if ($new_hashed_value == $hash) {
+
+			$result = $decrypted_value;
+
+		}
+
+		return $result;
+
+	}
+
+	public function main() {
+		
+		$core = self::decrypt(t3lib_div::_POST('encrypted'), t3lib_div::_POST('hashed'));
+		
+		// Mcrypt is not available, solr core did not arrive or was manipulated: give uo here.
+		if (empty($core)) {
+
+			return;
+
+		}
+
+		$url = trim(tx_dlf_solr::getSolrUrl($core), '/') . '/suggest/?q=' . t3lib_div::_POST('q');
+
+		if ($stream = fopen($url, 'r')) {
+			
+			$this -> content .= stream_get_contents($stream);
+			
+			fclose($stream);
+		
+		} else {
+
+			$this -> content .= "Could not connect to index server.";
+
+		}
+	}
+
+	public function printContent() {
+		echo $this -> content;
+	}
+
+}
+
+$suggest = t3lib_div::makeInstance('tx_dlf_search_suggest');
+$suggest->main();
+$suggest->printContent();
+
+?>
\ No newline at end of file

=== added file 'dlf/plugins/search/search_suggest.js'
--- dlf/plugins/search/search_suggest.js	1970-01-01 00:00:00 +0000
+++ dlf/plugins/search/search_suggest.js	2012-06-04 15:53:22 +0000
@@ -0,0 +1,29 @@
+$(
+	function(){
+	    // jQuery autocomplete integration
+	    $(".autocomplete").autocomplete({ 
+        	source: function( request, response ) {
+        		return $.post( 
+                	'/', 
+                	{ 
+                		eID: "tx_dlf_suggest", 
+                		q:  escape(request.term),
+                		encrypted: $("input[name='encrypted']").val(),
+                		hashed: $("input[name='hashed']").val()
+                	}, 
+                	function( xmlData ) { 
+						var result = new Array();
+	
+						$('arr[name="suggestion"] str', xmlData).each(function(i) {
+							if ($(this).text().indexOf(request.term) == 0) {
+								result.push($(this).text());
+							}
+						});
+	
+						return response(result);
+                	},
+					'xml');
+            }
+        });
+	}
+);
\ No newline at end of file

=== modified file 'dlf/plugins/search/template.tmpl'
--- dlf/plugins/search/template.tmpl	2012-03-16 09:06:25 +0000
+++ dlf/plugins/search/template.tmpl	2012-06-04 15:53:22 +0000
@@ -1,7 +1,8 @@
 <!-- ###TEMPLATE### -->
 <form class="tx-dlf-search-form" action="###ACTION_URL###" method="post" enctype="multipart/form-data">
 	<label for="###FIELD_QUERY###">###LABEL_QUERY###</label>
-	<input type="text" id="###FIELD_QUERY###" name="###FIELD_QUERY###" value="###QUERY###" />
+	<input type="text" id="###FIELD_QUERY###" name="###FIELD_QUERY###" value="###QUERY###" class="autocomplete" autocomplete="off" role="textbox" aria-autocomplete="list" aria-haspopup="true">
 	<input type="submit" value="###LABEL_SUBMIT###" />
+	###ADDITIONAL_INPUTS###
 </form>
 <!-- ###TEMPLATE### -->
\ No newline at end of file

=== added file 'dlf/t3jquery.txt'
--- dlf/t3jquery.txt	1970-01-01 00:00:00 +0000
+++ dlf/t3jquery.txt	2012-06-04 15:53:22 +0000
@@ -0,0 +1,1 @@
+components=jQuery,Core,Position,Autocomplete
\ No newline at end of file