GoonanismA Sporadic mix of the personal, political and programming

So, I’m currently doing a job (well Spire Software is but more on that later) where I’m building a registration form and payment gateway.

It has been a while since I’d done any payment gateways and I was looking forward to using the CakePHP frame work and it’s Security Component. But I’ve had a bit of a * forehead slap* moment which I thought might be worth sharing.

So basically the Security component protects against a range of of things like Cross Site Scripting (XSS – where someone tries to submit data to your site from another) and SQL injection. Being a payment gateway, I also wanted to use SSL.

So I found the Techno Geeks post which contains a very clever way of ensuring that all requests are forced to use SSL.

So I set up my beforeFilter method like this:

function beforeFilter() {
$this->Auth->allow('*');
$this->Security->blackHoleCallback = 'forceSSL';
$this->Security->requireSecure('confirmation', 'processing');
}
function forceSSL() {
$this->redirect('https://' . env('SERVER_NAME') . $this->here);
}

When I implemented it for the two pages that I wanted to use the Security Component I was getting my page, only with several undefined indexes.

Fundamentally, what I wasn’t understanding is what a ‘black hole’ was. Essentially what is meant by ‘Black Holed’ is the site kills the request and gives a 404 Error Page (or Page Not Found). This prevents any nastiness happening and gets rid of any annoying bots out there who just think the page doesn’t exist. So unless you meet the requirements of the Security Component (ie you’re not using SSL) you get black holed.

For the Security component to ‘ok’ a form submission it needs to meet a range of criteria, not least of which is that the request uses a Secure Server Licences (SSL – in other words the web address needs to start with https).

So what was happening is the form was being submitted from a page that was not using SSL and therefore did not meet the security requirements. Instead of just showing a 404 error as the Security Component would usually, it was calling the forceSSL() method which was redirecting me to the same page, only with a https URL. Instead of submitting a form to that page, I was now being redirected to it instead and all the form data that was submitted was being lost.

So to fix it I just changed the parameters I passed to the ‘requireSecure’ methor to an ‘*’ (so that all pages required it). So that line is changed to:

$this->Security->requireSecure('*');

By doing so, I ensure that the form is submitted from a page with SSL enabled (as it automatically redirects me) and the security component is happy, the redirection doesn’t happen and therefore our data is intact.

And we’re done.

The php mail() function is great. Super easy to use and no setup required. But it would seem some spam filters are often suspicious of email sent this way and rightly or wrongly I just don’t feel it is reliable enough.

I’m currently redesigning the Goonanism home page – it’s starting to look a bit stale (launch TBA) and I thought it was important that the contact page on the new site was as reliable as possible.

Knowing that my web hosts supported PEAR I decided to use PEAR’s Mail function instead. So I wrote the following script:
< ?php
    $name = $_POST['name'];
    $email = $_POST['email'];
    $message = $_POST['message'];
    require_once("Mail.php");
    $from = 'Website Enquiry ';
    $to = "Hammy Goonan ";
    $subject = "Website enquiry";
    $body = $message;
    $host = "hostdetails";
    $username = "username";
    $password = "password";
    $headers = array ('From' => $from,
        'To' => $to,
        'Subject' => $subject
    );
    $smtp = Mail::factory('smtp',
        array ('host' => $host,
            'auth' => true,
            'username' => $username,
            'password' => $password,
            'port' => '25'
        )
    );
    $mail = $smtp->send($to, $headers, $body);
    if (PEAR::isError($mail)) {
        echo($mail->getMessage());
    }
    else {
        echo("Message successfully sent!");
    }
?>

This gave me an error saying:

Class 'Net_SMTP' not found in /usr/local/php52/pear/Mail/smtp.php on line 210

So, using siteground as my host, I followed this tutorial.

Having uploaded the Net_STMP files and setting up my php.ini files I then got this error:

Fatal error: require_once() [function.require]: Failed opening required 'PEAR.php' (include_path='.:/usr/lib/php:/usr/local/lib/php:/home/goonanis/pear') in /home/goonanis/pear/Net_SMTP/SMTP.php

So it was clear to me that because of the new php.ini file, I would have to upload all the dependant packages to get this working.

Having uploaded various packages I was still getting an error saying:

Call to undefined method PEAR_Error::send()

Reading through various forums I realised that Mail::factory() will return a PEAR_Error object upon failure. So $smtp became a PEAR_Error so when I tried to call PEAR_Error::send() it wasn’t there, hence the error.

When I print_r() $smtp the PEAR_Error Object was actually throwing an error saying:

Unable to find class for driver smtp

A much more useful error message.

I only mention all of this because I had a lot of trouble sorting through forums to find this information out.

Anyway, the long and the short of it was that I needed to have the following packages and file structure for the PEAR Mail function to work:

pear
    /Mail
        /RFC822.php
        /mail.php
        /mock.php
        /null.php
        /sendmail.php
        /smtp.php
        /smtpmx.php
    /Net
        /SMTP.php
        /Socket.php
    /Mail.php
    /PEAR.php
    /PEAR5.php

Which you can find in the following PEAR packages:

• Pear
• Mail
• Net_Socket
• Net_STMP

I hope that helps!