falafel65 / mavo-php Goto Github PK

Hello and thanks for this nice mavo plugin.

I was messing with your code trying to remove authentication (make it work like the local storage mode does), but still using php to write files on server. Unfortunately couldn't make it.
I would appreciate any help and what to remove and make it work.

(I come from the designers world and my skills on coding are very primitive, so forgive me if the answer to my question is very obvious)

As @GalinhaLX mentionned, you may want to protect your data files of public access. I don't get why, but that's not the point.

The backend would the only one able to access the files via PHP file access.

Could you improve the readme to at least mention the file used to store the user info?

Hay Falafel 65 , I am using the mavo-php plug in and its working
I only struggle with the location where it saves images files (mv-portfolio app) .

I Uploaded al your php files at the top level but it puts al image uploads
also at the top level.

My mv-storage is set to datas/randomname.json would that not also be
the location to store image files to ?
mv-app="portfolio"
mv-storage-type="php"
mv-storage="datas/randomname.json">

I have low level knowledge of PHP so any help would be really appreciated.
btw Thanks for your work

Winn

Default will be to JSON and I'll add CSV and Text, as they are well supported by PHP and Mavo by default.

Other format should throw an error.

As @GalinhaLX mentionned, if you click on login the first time, you are redirect to the login page. So far, it's ok.
But after the login, you go back to the original app page, and then to be logged you have to click again on login.

The problem reside in the fact that the Mavo app does not have the user infos on the initialisation stage (= constructor) so it won't recognize you as logged until it ask the server if the user is logged (user is in $_SESSION).

Two solutions :

1. Force the retrieving of user data from server on init
2. Store the user info on local device (and have to check if the user is still really logged)

• Check if overwriting files
• Check if path exists, and if not, create it
• Check if ressource is safe to write (not remote and such)
• Send back an url friendly filename

Bonjour @Falafel65

I've been able to install this plug in, and read data.json file correctly

But I'm not able to edit properties and save data (despite correct file permissions)

I guess it's the same cause @LeaVerou and @DmitrySharabin
are talking about in another plugin here

I get this error:

putFile and putData methods are not checking for authorized user session. Looks like it's serious vulnerability for user data.