Hey Fred,

I’m glad you like the app.

Please take a look to the documentation, since everything is explained there related to moving files above document root (which is highly recommended btw): https://docs.vanguardapp.io/installation.html#application-url

Regards,

Milos

Hi Milos,

Thanks for the quick reply.

I have purchased Advanced Security for the security of mu dashboard. Your reply is related to the Vanguard app. Do you recommend this for the back end of a dashboard?

Regards, Fred.

Hey Fred,

Ah, you are right. I’m sorry about that, I haven’t noticed that you were asking about AS.

For AS you can move most of the files from “ASEngine” folder (everything except ASAjax.php file) out of document root, as well as complete “vendor” folder. After that you will need to update the path to AS.php file in all files where it is used (ASEngine/ASAjax.php and files like login.php, index.php etc). You don’t have to move other files out of document root.

About using Vanguard over AS, it really depends on what your are going to build and on your knowledge of PHP (and Laravel framework, which is used by Vanguard). If you don’t need some advanced features that Vanguard provides, AS is the way to go.

Regards,

Milos

Hey,

I’m glad you like the script!

Well the whole registration scenario is pretty simple, when you fill out the registration form and click “Create Account” button, an on button click callback function is executed (check register.js file), which first do some basic javascript validation and then executes register.registerUser javascript function and send an AJAX request to the server (to ASAjax.php file with action : "registerUser" parameter).

In ASAjax.php file, this action parameter is being checked and according to that parameter specific handler is called. Server then validates this register request again and create user if everything is ok (check register method inside ASRegister class).

Hopefully this will guide you and help you to properly understand how everything works.

Regards,

Milos

Hey Milos,

That definitely helped a lot, I am now starting to understand the modular hierarchy of your system by tracing the data route with respect to the order you explained above, and I guess I’ll eventually be able to build my web app with your system in the core…

Thanks a lot my friend, for both your support and the system itself, have a great day.

Hey Phu,

Well yeah, it looks like session cookie is not kept by the browser for some reason. So I would say that it is specific to her browser only. Which browser does she use? If you can, ask her to try using some other browser to see if she can log in in that case.

Regards,

Milos

Hi Milos,

Thanks for your quick response. She was using Edge on her laptop. She also tried on mobile Chrome but same thing happened. I asked her to install Chrome on her laptop, but haven’t heard from her again. I also think the problem is on her browser’s side, not the server. What you think reasons that cause this kind of problem, I mean can you guess what’s wrong with the browser?

Hey,

Well I cannot be sure what is the problem, but it has something to do with session cookie for sure. Maybe it is not configured to allow cookies, or something like that. If here “last_login” timestamp is being updated it means that she is being authenticated properly. Since nobody else is experiencing the same issues, it makes sense that the problem is with her browser.

Regards,

Milos

Hi Milos,

I have one more question in the meantime. How could I know the list of users who are currently being logged in to the website?

Thanks so much!

Hey,

Well you will have to bind that “db1” database to the container, the same way that “db” is bound. Check the AS.php file and you will see how it works. Eventually, you should just copy the code and update the credentials that are being passed to the constructor of ASDatabase class.

About your second question, it is not possible to list currently logged users in AS out of the box. If you would want to implement that, you should implement database session driver (to make all sessions be stored in database instead of plain file, which is PHP default session driver) and assign sessions to specific user after successful authentication.

Regards,

Milos

Thanks so much for your help. I am clear abt this.

Hey,

Well I’ll need some more info about the issue so I can help. Have you stuck on installation step where you need to provide database credentials?

Regards,

Milos

Hey,

I’m really sorry but, if you need my help, please extend your support.

Thanks for understanding.

Regards,

Milos

Hey,

Well from what I can see from the error above, you have some permission issues and session cannot be started properly. That’s probably because your are including the code from your main domain on your subdomain, which is probably running under different system user.

If you just want to load database data, you don’t need to start the session on your subdomains, then you can create another file that is similar to ASEngine/AS.php file but without ASSession::startSession(); code inside it. This will allow you to use all the AS classes inside your subdomain projects, but it won’t start the session so you won’t see these permissions errors.

However, since it won’t start the session, it means that you won’t be able to see the authenticated user etc. If you still need this feature, then the easiest way for you is to install AS separately on your subdomain.

Regards,

Milos

thanks and regards dear milos

What happens if I re-install everything and do all the process from scratch? can I do that? I believe I messed it all up

Ok, I re-installed everything and configured it and I get this error when I try to login:

ReferenceError: CryptoJS is not defined[Saber más] login.js:46:5 login.loginUser https://www.mydomain.com/ASLibrary/js/login.js:46:5 <anónimo> https://www.mydomain.com/ASLibrary/js/login.js:26:13 dispatch https://www.mydomain.com/assets/js/jquery.min.js:3:8497 add/r.handle https://www.mydomain.com/assets/js/jquery.min.js:3:5235

Hey,

CryptoJS is defined inside js file called assets/js/sha512.js, which is included at the bottom of the login.php page.

Now, the only possible reasons why it doesn’t work for you are:

1) It is not being loaded since your server configuration (or files/folders permissions) does not allow that file to be loaded. You can easily see that inside the browser’s console when you access the login page.

2) You have removed the script code from the bottom of login.php page.

So, make sure that all javascript files are loaded properly and that you haven’t removed any code from original AS script.

Regards,

Milos

I installed again with full granted privileges for my database user and it installed the tables correctly but, now I cannot login nor register, what can it be?

Same as phungoctran, I just figured it out

Thank you anyway

Hey Jeffrey,

CSRF token is automatically set on each AJAX request you make to the server. It is not stored inside the db and it is generated per user session, which means that if you log out and log in again your CSRF token will be different.

It’s not the same as API tokens that you would use to secure your API, if that is what you are asking. You can learn more about CSRF protection here: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

Regards,

Milos

Hey,

Well you will add new column into as_users table where you will save the language, and then fetch it on every request and set the interface language by calling ASLang::setLanguage() method.

However, as you said, if user is not logged in then you won’t be able to see which language he has selected, and you will have to rely on language cookie if it exist. If cookie does not exist, then you will have to display him default language.

Since this is the default behavior of the AS script (it will set the cookie whenever user change the language), I don’t see any good reason on modifying it and storing the language inside the DB.

Regards,

Milos

Hey,

Thanks for letting me know. Will check it ASAP.

What about other social auth providers (Facebook and Google+), do you have the same issues with them?

Regards,

Milos

Hey,

Well it probably has nothing to do with AS script. Just make sure that you include your datepicker plugin after jQuery is included and everything should work.

Regards,

Milos

Hey,

Does you server meet the requirements in terms of PHP version? If it does, can you please provide the URL to where you have uploaded your script so I can take a look and see what can be a problem?

Regards,

Milos

Hey,

Having a token in hidden input field is completely fine approach. The token is different for each session, so there is no threat if someone see his token inside the HTML.

CSRF protection only makes sense for requests that change the application state (requests that usually write some data to db), and get request should not change your app state. Check the following url to learn more about CSRF: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

Regards,

Milos

Milos,

Thanks for your explanation and the helpful link. Now I understand more about CSRF. In my app, however, before figuring out how to implement your CSRF code with POST method, I was using all GET method to request data and also to write data to database. Because at the end of AS.php, you never checked for GET request to the server, so even when I am using GET to make change to the server, CSRF has no use. What I mean is that I can use GET http request to make change to database, therefore should we consider CSRF for GET as well?

Hey,

Well yeah, if you are using $_GET requests for changing the application state, you will should add CSRF for those requests too. However, I highly recommend to switch those requests to POST.

Regards,

Milos

Hey,

Thanks for providing the code here. Yes, it looks like when you send serialized form it doesn’t append CSRF token to the data being sent to the server.

One easy solution for you is to add the following hidden input field inside your ”#form-zera-options” form, like following:

<form>
//...
<input type="hidden" name="<?= ASCsrf::TOKEN_NAME ?>" value="<?= ASCsrf::getToken() ?>" />
//...
</form>

This means that once form is serialized, CSRF token will be serialized too and sent automatically to the server.

Regards,

Milos

Great idea! Thanks.

Hey,

Can you provide the link to your application so I can see what can be a problem with it? Are you able to log in as administrator?

Regards,

Milos

I got it figured out

Trying to add an item to the navigation if user is logged in. Found this code in the docs

$role = app(‘current_user’)->role;

<?php if($role != ‘user’): ?>

Leave comment

<textarea id=”comment-text”></textarea> <button class=”btn btn-success” id=”comment”>Comment</button> <?php else: ?>

You can’t post comments here until admin change your role.

<?php endif; ?>

but where do I put it, and does it need to be in some sort of container?

Hey,

Which navigation exactly? If it is sidebar, then check templates/sidebar.php file and you will see how those sidebar items are being rendered. If you want to modify the header, check templates/header.php file.

The code you posted above is just an example of how you can render something according to the user’s role. If you want to check if user is logged in, then just use app('login')->isLoggedIn() which will return true if user is logged in.

Regards,

Milos

Hey,

Of course that you can use it without ajax, just in that case don’t forget to include the csrf token in each form you create, like following:

<input type="hidden" name="<?= ASCsrf::getTokenName() ?>" value="<?= ASCsrf::getToken() ?>" /> 

. There is one more thing that you need to edit, and that is the ASCsrf class itself. You need to modify isValidRequest method there to look like following:

private static function isValidRequest()
    {
        return self::isValidReferer();
    }

About emails, you will have to use some external SMTP server to send emails from localhost.

Regards,

Milos

Hey,

It’s not a good idea to remove CSRF protection.

Can you please provide me the url to your script so I can take a look and see why CSRF token is not being sent?

Regards,

Milos

“It’s not a good idea to remove CSRF protection.”

But it is a protected page, that can only be seen by admin (me). With this form I am sending messages to registered users.

I would need to give you access as admin to see that…

How would you check that? I can do it and show you the results.

Hey,

In that case it’s not a big deal, but just make sure that only you can submit the ajax request, since from above code anyone can submit the ajax request (check ASAjax.php file since there is “onlyAdmin” method that you can use).

Regards,

Milos