I’ve been pulling my hair out for a few hours trying to figure this one out so I thought it was probably worth writing a quick post about it.

I’d installed the Webshopapps Premium Order Export Module for a client which worked perfectly as expected. However the client wanted shipment tracking information included in the report so I had to modify it slightly.

Getting the Shipment Method was straight forward enough:

$order->getShippingDescription()

However the Tracking number proved to be much more difficult. This is how I ended up doing it:

$tracking = Mage::getResourceModel('sales/order_shipment_track_collection')
	->setOrderFilter($order)
	->getData();
$trackingNumber = $trackings[0]['number'];

Easy enough – I just had to cross reference a few forum posts to figure it out so I thought it was worth mentioning here.

Please note that I’m assuming there is only one tracking number, you might want to modify this if you want the most recent tracking number.

If you’ve got a better way of doing it, please leave a comment.

Today I quit Facebook. I’ve been mulling over it for quite some time now and, in a moment of impulsiveness, I clicked the delete button.

It was time to stop complaining and put my money where my mouth is (was?). I’d actively withdrawn from it anyway, so why not take the final step and leave?

Of course my account won’t actually be deleted for another fortnight, that’s just how FB rolls. They’re worried that I might change my mind in that time so have, very thoughtfully, decided need a bit of a cooling off period.

So why did I do it?

We all know Facebook are essentially a company that trades in a very valuable commodity – highly targeted marketing. Facebook know a lot about you and sell that information to anyone that wants it. Like any of these services, that’s the trade off. You get access to the world largest social media service with a user-base of around 800 million and in return Facebook sells information about you to advertisers. (So why do I keep getting weight loss ads served to my Facebook page?)

So the question is: do I feel that is a fair trade. Is it worth commodifying my personal information so that I can keep up to date with what my friends just ate for dinner? Truthfully, it is up to a point, and up until today I’ve been happy to pay that price. I’m living in London at the moment and the vast majority of the people I know and love are living in Melbourne so I want to see pictures of them and their kids.

I’m also someone that likes to think of themselves as an activist. Whist I’m not as active as I used to be, Facebook is a really handy tool for an activist. When I put together martinfergusonisaratbastard.com it got about 300 hits in the first day – most of which came from Facebook. So I’m reluctant to let that go.

Finally, as far as my reluctance to leave Facebook goes, I’m a web developer. Facebook is central to the online world so I feel like I should do my best to keep up with what is happening on Facebook, at lease from a technological perspective.

So, with all these good reasons to stay on Facebook, why would I leave?

Ownership, commodification and privacy, to name three. Facebook has never really been satisfactory in any of these areas and I’ve finally had enough.

Ownership
I’ve always disliked iPhoto and iTunes. Their default status (and I know you can turn this off) has the program managing your files. That bothers me. They are my files and I’ll do with them as I please thank you very much. My first MP3 player was a 40 Gig iAudio that was essentially just a hard drive. It would simply play every song in the folder you navigated to. It had a horrible interface and was quite clunky but I loved it. It played every format under the sun (critically, including ogg) and I could move files on and off it as I pleased without a program or anything like that. They were my files, why wouldn’t I be able to?

The same can be said for Facebook. I can’t just take my data and go home. I can’t just get a copy of every photo and video I’ve uploaded and do with it as I please.

In contrast, I’m heavily integrated with Google. They aren’t perfect either but at lease with Google I can take my data and go elsewhere whenever I wish. Ironically, it will be when Google take this capacity away from me that I’ll feel the need to leave.

There are also intellectual property issues here that are probably beyond the preview of this post. But who owns the copyright over a photo that I upload to Facebook or a status update? What can the images I’ve uploaded be used for? I don’t have control over that and, fundamentally, I should.

All of this combined with Facebook’s persistant changing of the rules and defaulting everything to public has eroded my faith.

Commodification
Of course Google commodifies my personal information as well, but with Facebook it seems far more intrusive. The information is less anonymised, more readily available for sale and just seems more insidious than other services. Surely this will only get worse with it multi-billion dollar Initial Public Offering

I don’t think it is necessarily problematic to sell things in a targeted manner to users of a service if they have opted in. It’s something I would consider exploiting for Sommelier.net.au. But Facebook take this too far. The information that can be bought by advertisers is far more detailed than I am comfortable with a corporation having.

Which ties into my final point.

Privacy
Facebook knows a lot about you. A lot. A terrifying amount. More than I am happy for any one person, let alone corporation, to know.

I’m a strongly libertarian sort of person. Civil liberties are central to everything I believe in and key to protecting one’s rights is privacy.

Facebook knows too much about me already and has a tendency to broadcast that information whenever it can. It’s key to their business model.

In addition, I don’t have enough trust in a corporation like Facebook to protect my privacy. It isn’t in their interest to do so. I think it’s safe to say that there isn’t a government department in the world that knows as much about me as Facebook and they are far less accountable. Hell, the FBI have admitted to being able to make staffing reductions due to the amount of information they can now get just by looking someone up on Facebook.

Moreover, Facebook track you by stealth when you’re away from the site. Every ‘Like’ button on a website is another little spy for Facebook. And Facebook aren’t playing fairly in this realm. You simply shouldn’t be able to track someone once they have left that site. But Facebook do it incessantly, even once you’ve logged out. Hell, they keep ‘shadow’ profiles of people that don’t have Facebook accounts. To quote George HW Bush, “this aggression will not stand.”

As part of my discontent with Facebook’s surveillance techniques, I will also be removing ‘Like’ Buttons from any website I run. Especially Your Voice in House so people can use the service without a fear that they will be tracked by a corporation. It’s only ego-metrics anyway.

So that’s it. I’m sick of being sold, I’m sick of being spied on and I’m sick of not being able to control my own data. I cannot tolerate this social compact any longer. I quit. I’ll miss knowing what my friends are up, but they’ve all got my email address, they all know my blog and they are all welcome to follow me on Twitter. Hell, Google me if you need.

So who knows. Maybe I’ll utilise that 14 day window and reactivate my account. Maybe I create a new account with a nom de plume so i can continue to spy on ex-girlfriends friend’s children as they grow. But for now at least, I’m feeling quite liberated.

The first update for Gallery Only is now available.

It makes some minor changes to the layout on both the HTML and CSS side which means that anything appearing below the gallery is spaced out a little better.

We’ve added a new class, .go_clear which adds this spacing and could be edited for the purposes of customisation if needed.

I’m pretty excited to demonstrate by new Gallery Plugin for WordPress. It’s the first one I’ve generated from scratch and uploaded to the WordPress site.

The plugin replaces the default gallery with clean looking gallery Carousel which utilises the Moodular jQuery plugin

To demonstrate it here are some photos taken by Ariane Barton on our recent holiday:

I’ll update this article once you can download the plugin from the WordPress Site.

Update: You can download the plugin from here.

Update: and it’s now up on the WordPress Plugin Directory site.

I’ve had the need for a list of countries lately. There are plenty around but the ones I could find in .csv format were all at least a few years out of date.

So after a fair bit of cut and paste I have pulled together a list which you, dear reader, are most welcome to.

You can down the csv of countries and country codes here | and the sql file here.

If you notice any errors, please let me know and I’ll update the files.

I’ve also pasted my list over the page.

“Afghanistan”;”AF”
“Albania”;”AL”
“Algeria”;”DZ”
“American Samoa”;”AS”
“Andorra”;”AD”
“Angola”;”AO”
“Anguilla”;”AI”
“Antarctica”;”AQ”
“Antigua and Barbuda”;”AG”
“Argentina”;”AR”
“Armenia”;”AM”
“Aruba”;”AW”
“Australia”;”AU”
“Austria”;”AT”
“Azerbaijan”;”AZ”
“Bahamas, The”;”BS”
“Bahrain”;”BH”
“Bangladesh”;”BD”
“Barbados”;”BB”
“Belarus”;”BY”
“Belgium”;”BE”
“Belize”;”BZ”
“Benin”;”BJ”
“Bhutan”;”BT”
“Bolivia”;”BO”
“Bosnia and Herzegovina”;”BA”
“Botswana”;”BW”
“Bouvet Island”;”BV”
“Brazil”;”BR”
“British Indian Ocean Territory”;”IO”
“British Virgin Islands”;”VG”
“Brunei Darussalam”;”BN”
“Bulgaria”;”BG”
“Burkina Faso”;”BF”
“Burundi”;”BI”
“Cambodia”;”KH”
“Cameroon”;”CM”
“Canada”;”CA”
“Cape Verde”;”CV”
“Cayman Islands”;”KY”
“Central African Republic”;”CF”
“Chad”;”TD”
“Chile”;”CL”
“China”;”CN”
“Christmas Island”;”CX”
“Cocos (Keeling) Islands”;”CC”
“Colombia”;”CO”
“Comoros”;”KM”
“Congo”;”CG”
“Democratic Republic of the Congo”;”CD”
“Cook Islands”;”CK”
“Costa Rica”;”CR”
“Croatia”;”HR”
“Cuba”;”CU”
“Cyprus”;”CY”
“Czech Republic”;”CZ”
“Denmark”;”DK”
“Djibouti”;”DJ”
“Dominica”;”DM”
“Dominican Republic”;”DO”
“East Timor (Timor-Leste)”;”TP”
“Ecuador”;”EC”
“Egypt”;”EG”
“El Salvador”;”SV”
“Equatorial Guinea”;”GQ”
“Eritrea”;”ER”
“Estonia”;”EE”
“Ethiopia”;”ET”
“European Union”;”EU”
“Falkland Islands (Malvinas)”;”FK”
“Faroe Islands”;”FO”
“Fiji”;”FJ”
“Finland”;”FI”
“France”;”FR”
“French Guiana”;”GF”
“French Polynesia”;”PF”
“French Southern Territory”;”TF”
“Gabon”;”GA”
“Gambia”;”GM”
“Georgia”;”GE”
“Germany”;”DE”
“Ghana”;”GH”
“Gibraltar”;”GI”
“Greece”;”GR”
“Greenland”;”GL”
“Grenada”;”GD”
“Guadeloupe”;”GP”
“Guam”;”GU”
“Guatemala”;”GT”
“Guernsey and Alderney”;”GG”
“Guinea”;”GN”
“Guinea-Bissau”;”GW”
“Guyana”;”GY”
“Haiti”;”HT”
“Heard & McDonald Is.(AU)”;”HM”
“Honduras”;”HN”
“Hong Kong, (China)”;”HK”
“Hungary”;”HU”
“Iceland”;”IS”
“India”;”IN”
“Indonesia”;”ID”
“Iran”;”IR”
“Iraq”;”IQ”
“Ireland”;”IE”
“Israel”;”IL”
“Italy”;”IT”
“Ivory Coast (Cote d’Ivoire)”;”CI”
“Jamaica”;”JM”
“Japan”;”JP”
“Jersey”;”JE”
“Jordan”;”JO”
“Kazakhstan”;”KZ”
“Kenya”;”KE”
“Kiribati”;”KI”
“Democratic People’s Republic of Korea (North Korea)”;”KP”
“Republic of Korea (South Korea)”;”KR”
“Kosovo”;”KV”
“Kuwait”;”KW”
“Kyrgyzstan”;”KG”
“Lao”;”LA”
“Latvia”;”LV”
“Lebanon”;”LB”
“Lesotho”;”LS”
“Liberia”;”LR”
“Libyan Arab Jamahiriya”;”LY”
“Liechtenstein”;”LI”
“Lithuania”;”LT”
“Luxembourg”;”LU”
“Macao, (China)”;”MO”
“Macedonia, TFYR”;”MK”
“Madagascar”;”MG”
“Malawi”;”MW”
“Malaysia”;”MY”
“Maldives”;”MV”
“Mali”;”ML”
“Malta”;”MT”
“Man, Isle of”;”IM”
“Marshall Islands”;”MH”
“Martinique (FR)”;”MQ”
“Mauritania”;”MR”
“Mauritius”;”MU”
“Mayotte (FR)”;”YT”
“Mexico”;”MX”
“Micronesia, Fed. States of”;”FM”
“Moldova”;”MD”
“Monaco”;”MC”
“Mongolia”;”MN”
“Montenegro”;”CS”
“Montserrat”;”MS”
“Morocco”;”MA”
“Mozambique”;”MZ”
“Myanmar (ex-Burma)”;”MM”
“Namibia”;”NA”
“Nauru”;”NR”
“Nepal”;”NP”
“Netherlands”;”NL”
“Netherlands Antilles”;”AN”
“New Caledonia”;”NC”
“New Zealand”;”NZ”
“Nicaragua”;”NI”
“Niger”;”NE”
“Nigeria”;”NG”
“Niue”;”NU”
“Norfolk Island”;”NF”
“Northern Mariana Islands”;”MP4″
“Norway”;”NO”
“Oman”;”OM”
“Pakistan”;”PK”
“Palau”;”PW”
“Palestinian Territory”;”PS”
“Panama”;”PA”
“Papua New Guinea”;”PG”
“Paraguay”;”PY”
“Peru”;”PE”
“Philippines”;”PH”
“Pitcairn Island”;”PN”
“Poland”;”PL”
“Portugal”;”PT”
“Puerto Rico”;”PR”
“Qatar”;”QA”
“Reunion (FR)”;”RE”
“Romania”;”RO”
“Russia”;”RU”
“Rwanda”;”RW”
“Saint Barthelemy (FR)”;”BL”
“Saint Helena (UK)”;”SH”
“Saint Kitts and Nevis”;”KN”
“Saint Lucia”;”LC”
“Saint Martin (FR)”;”MF”
“S Pierre & Miquelon (FR)”;”PM”
“S Vincent & Grenadines”;”VC”
“Samoa”;”WS”
“San Marino”;”SM”
“Sao Tome and Principe”;”ST”
“Saudi Arabia”;”SA”
“Senegal”;”SN”
“Serbia”;”RS”
“Seychelles”;”SC”
“Sierra Leone”;”SL”
“Singapore”;”SG”
“Slovakia”;”SK”
“Slovenia”;”SI”
“Solomon Islands”;”SB”
“Somalia”;”SO”
“South Africa”;”ZA”
“S.George & S.Sandwich”;”GS”
“Spain”;”ES”
“Sri Lanka”;”LK”
“Sudan”;”SD”
“Suriname”;”SR”
“Svalbard and Jan Mayen Is.”;”SJ”
“Swaziland”;”SZ”
“Sweden”;”SE”
“Switzerland”;”CH”
“Syrian Arab Republic”;”SY”
“Taiwan”;”TW”
“Tajikistan”;”TJ”
“Tanzania”;”TZ”
“Thailand”;”TH”
“Timor-Leste (East Timor)”;”TL”
“Togo”;”TG”
“Tokelau”;”TK”
“Tonga”;”TO”
“Trinidad and Tobago”;”TT”
“Tunisia”;”TN”
“Turkey”;”TR”
“Turkmenistan”;”TM”
“Turks and Caicos Islands”;”TC”
“Tuvalu”;”TV”
“Uganda”;”UG”
“Ukraine”;”UA”
“United Arab Emirates”;”AE”
“United Kingdom”;”UK”
“United States”;”US”
“US Minor Outlying Isl.”;”UM”
“Uruguay”;”UY”
“Uzbekistan”;”UZ”
“Vanuatu”;”VU”
“Vatican (Holy See)”;”VA”
“Venezuela”;”VE”
“Viet Nam”;”VN”
“Virgin Islands, U.S.”;”VI”
“Wallis and Futuna”;”WF”
“Western Sahara”;”EH”
“Yemen”;”YE”
“Zambia”;”ZM”
“Zimbabwe”;”ZW”

Today’s Age reports that Australian Centre for Contemporary Art is hurrying to defend this:

In the installation, artists and the public are invited to email works to the gallery, which are vetted, printed and displayed in a process streamed live to a website.

But the project, called myworkisintheaustraliancentreforcontemporaryart, is a promotion for Hewlett Packard, and the fine print gives the technology giant extensive copyright.

It just struck me as a great example of all that is wrong with the current Intellectual Property regime that permeates most of the globe at the moment. It typifies the loss of control over their own art that many artists are facing and the concentration of intellectual property into the hands of a shrinking number of highly litigious multi-national corporations.

To state the obvious, how does this do anything to encourage creativity or protect artists?

I’ve just returned home from the ACTU Media and Communications Conference where I delivered a presentation on free, Open-Source Content Management Systems in the context of cheaper alternatives for Union websites.

Please feel free to leave comments/questions below and note that I do freelance web development work which you can email me about hammy@goonanism.com

See over the page for my presentation.

Free and Open-Source Content Management Systems have come a long way in recent years. The software is now quite mature and very powerful enabling just about everything you could want on a website.

These systems are an ideal way to set up a campaign website and can be extended to become fully blown, but cost effective, union sites.

What is a Content Management System?
A CMS is a piece of software that manages the display and structure of content. This presentation is more specifically about Website Content Management Systems which are pieces of software that can be used to manage a website’s content, appearance, navigation and just about everything else.

They take most of the coding out of web development and make managing a website much more user friendly.

What is Open Source Software?
In essence, Open Source Software is software that is available in source code form. This means that anyone can view and edit that code and it is usually developed in a collaborative environment.

Perhaps the best known examples of Open Source Software are the Firefox web browser and the Linux operating system.

Why Open Source?
Being free is an attractive element. But OSS also tends to be both user friendly and highly customisable. It also tends to be very stable because the source code can be viewed and edited, therefore any security or programmatic vulnerabilities are usually found and patched quite quickly. It is also much easier for developers to create addons that are commonly released for free as well which means you can extend the functionality of the site very easily using these free addons.

Open Source software is also often quite ‘Light weight’ which means that it doesn’t put much strain on a computer’s hardware.

In addition, by using an open source CMS, all the ‘grunt’ work of putting a website together is already done. All you have to do is add your content structure and content which is a considerable time save and time saving means cost saving.

What sort of setup do I need?
Just a brief technical note: if you intend to develop a website yourself you will need the following:

• A Web server that is running LAMP (Linux, Apache, MySQL and PHP: these are the operating system, server, database and programming language that all of the WCM site I mention here require)
• Ideally it will include either cPanel or Plesk which not only help with the management of the web server but can often install each of the WCMs we mention here with just a couple of clicks.

Which WCM to use?
Website Content Management systems have come a long way in the past 5 or so years and it is now possible to develop a website with little technical knowledge.

3 WCMs in particular lead the way: WordPress, Joomla and Drupal. They have the greatest market share, they are most widely used by developers and freelancers and there is a considerable amount of literature available for each in print and online. They are each very powerful and relatively simple to use given their capacity.

Using one of these WCMs should also dramatically reduce the amount of work that a developer has to do to put a website together that can mean a considerable saving. However, if you would like to go it alone, installing these CMSs is easy providing your hosting includes cPanel or Plesk.

WordPress
Wordpress (wordpress.org) is a very popular blogging platform. It generally displays content chronologically and is geared towards fairly dynamic/regularly changing content. However, because it is so easily customisable, it is possible to make the content appear in just about any manner.

WordPress probably works best as a smaller site that will complement your main site such as a campaign site. Examples include:

• http://manufacturingalliance.org.au/
• http://fairgoforbillionaires.com.au

But can also be used for main site – see Maritime Union of NZ:

• http://www.munz.org.nz/

Other examples of WordPress sites include:

• http://cathbowtell.com
• http://crikey.com.au
• http://www.number10.gov.uk
• http://www.populationmedia.org/
• http://ourworld.unu.edu/en/
• http://www.bgcomaha.org/
• http://livestrongblog.org/
• http://www.childrensrights.org/

Joomla!
Joomla! (joomla.org) is probably the most ‘complete’ WCM system of the three. Whilst the content structure takes a little longer to get used to, it is also quite flexible, allowing you to display content in a wide variety of ways. There is a huge number of 3rd party plugins and templates that are available as well.

It has the potential for ‘second-level’ navigation and is therefore suited to ‘deeper’ informational sites and membership / login areas.

For example:
http://www.asuvic.org

Other examples of Joomla! Sites include:

• http://premier.vic.gov.au
• http://hacsu.asn.au
• http://www.alliance.org.au/
• http://www.asumembers.org.au/
• http://www.asuqld.asn.au/
• http://bettermentalhealth.org.au

Drupal
Drupal (drupal.org) is both the most flexible system and the most complex system. Its content structure has two tiers and if you are creating a very basic site it is a very easy system to use. However once you want to do a bit more it tends to get more complex quite quickly.

A lot of basic tasks require 3rd party plugins and many 3rd party plugins rely on other 3rd party plugins which can mean untangling a web of different bits and pieces to get a task done. The documentation for these addons is also lacking and generally very technical as is broader community support for help on more basic issues.

However the additional flexibility enables a huge range of things and makes Drupal capable of just about any task at just about any scale.

For example the ACTU’s new Extranet which is based on Drupal and has been extended to include complex user permissions and a document management system among other things:

http://www.uweb.actu.org.au/

On the other hand, Oxfam have a much simpler Drupal-based site that demonstrates the way Drupal can be set up as a campaign site with a series of actions:

http://www.oxfam.org/

Other examples include:

• http://melbourne.foe.org.au
• http://www.twulocal100.org/
• http://massbuildingtrades.org/
• http://gbclc.com/
• http://ufcwone.org/
• http://www.whitehouse.gov/
• http://www.hrw.org/
• http://www.pm.gov.au/
• http://www.amnesty.org

Until a few days ago, I’d seen ‘Grog’s Gamut‘ appear in my twitter feed from time to time as someone I follow retweeted him, but never really paid attention.

Of course since then James Massola has revealed the identity of Grog’s Gamut and the interwebs have spewed forth huge volumes of work on the man and his anonymity. This is hardly surprising given that it is an issues that just about everyone that blogs or tweets has put some thought into from time to time.

For the record, I don’t think it was unethical to out Grog’s Gamut. However, I do think it’s quite boring and I question to value in doing so. There is probably a little public interest, not because he’s a public servant, but because it is gossip. I don’t see how traditional media expects to be taken seriously when it prints boring rubbish like this.

To make matters worse, the boringness of this sort of reporting is further punctuated by the fact that the only reason anyone is interested in Grog’s Gamut is because he’s quite good at what he does and is yet another example of new media are out performing traditional media.

But for me the more interesting question the issue raises is on of trust and legitimacy. In traditional media, what is written falls under the banner of the once respected masthead of the paper they are writing for. New Media practitioners have to actually earn the trust of their audience and that is even harder to do if you are anonymous.

Grog’s Gamut was clearly a good read – so good he managed to influence the ABC’s the managing director Mark Scott. By all accounts he was insightful and that cut through the cacophony of other blogs that are less insightful (like this one). To have your writing noticed, acknowledged and trusted* when no one knows who you are or what your credentials are is quite remarkable.

*The same issue presents itself to wikileaks and I think it’s fair to say that there is currently a concerted effort to undermine the trust that the organisation enjoys that legitimacy by a range of people.

Criticism of Labor’s National Broadband Network all seems to be pointed fairly squarely at the economic viability of the scheme. Or perhaps more specifically, is it necessary to provide fibre to the home for 93% of the population when those in more remote areas could simply use wireless while the major population centres get fibre to the premises?

In yesterday’s Crikey Peter J.Cox of Cox Media (who could really do with a new website) said:

My concern is not with the need for national broadband but with the arguments for delivering a 100 MB, or 1 GB fibre, system to nearly every home in the country at an extraordinary cost.

… and Malcolm Turnbull took a similar line in the Sydney Morning Herald today:

The real question is about the government spending $43 billion on an infrastructure project and asserting, but not demonstrating, that it will deliver value for money.

Now, just to be clear, $43 billion is a huge amount of money. But I think it is money well spent. Of course I don’t know the details of the way it will be spent but I’m happy for our Government to spend $43 billion on providing 93% of the population which up to 1Gb internet connects, both up and down. Providing these speeds both up and down is a very important point as well and enables a wide range of things that ADSL wireless do not and cannot have the capacity for.

Better still, the technology is as future proof as you can get. We’re talking about approaching the speed of light which is generally the upper limit of human endeavours for now. Moreover, it’s capacity is astounding, far exceeding anything wireless or satellite could even begin to imagine.

By and large, the market system is pretty good at determining prices for most things. However it clearly fails in some key areas. Health and education are the obvious two but there are others. In a country the size of Australia, market forces will not be able to provide rural and regional Australia (ie those most isolated and reliant on telecommunications) with an internet service of the likes of the NBN. Therefore it is necessary for the government to step in, spend up and deliver a service to 93% of the population that will put us on par with countries like South Korea. Imagine that, Broken Hill having the same sorts of internet speeds as Japan.

The Rudd Government had two good ideas, their stimulus package (thank you for my $900) and their NBN policy. If there is a problem with the NBN, it is that the Government intends to sell it at some stage in the future. I say we should keep it in public hands.

So, I’m currently doing a job (well Spire Software is but more on that later) where I’m building a registration form and payment gateway.

It has been a while since I’d done any payment gateways and I was looking forward to using the CakePHP frame work and it’s Security Component. But I’ve had a bit of a * forehead slap* moment which I thought might be worth sharing.

So basically the Security component protects against a range of of things like Cross Site Scripting (XSS – where someone tries to submit data to your site from another) and SQL injection. Being a payment gateway, I also wanted to use SSL.

So I found the Techno Geeks post which contains a very clever way of ensuring that all requests are forced to use SSL.

So I set up my beforeFilter method like this:

function beforeFilter() {
$this->Auth->allow('*');
$this->Security->blackHoleCallback = 'forceSSL';
$this->Security->requireSecure('confirmation', 'processing');
}
function forceSSL() {
$this->redirect('https://' . env('SERVER_NAME') . $this->here);
}

When I implemented it for the two pages that I wanted to use the Security Component I was getting my page, only with several undefined indexes.

Fundamentally, what I wasn’t understanding is what a ‘black hole’ was. Essentially what is meant by ‘Black Holed’ is the site kills the request and gives a 404 Error Page (or Page Not Found). This prevents any nastiness happening and gets rid of any annoying bots out there who just think the page doesn’t exist. So unless you meet the requirements of the Security Component (ie you’re not using SSL) you get black holed.

For the Security component to ‘ok’ a form submission it needs to meet a range of criteria, not least of which is that the request uses a Secure Server Licences (SSL – in other words the web address needs to start with https).

So what was happening is the form was being submitted from a page that was not using SSL and therefore did not meet the security requirements. Instead of just showing a 404 error as the Security Component would usually, it was calling the forceSSL() method which was redirecting me to the same page, only with a https URL. Instead of submitting a form to that page, I was now being redirected to it instead and all the form data that was submitted was being lost.

So to fix it I just changed the parameters I passed to the ‘requireSecure’ methor to an ‘*’ (so that all pages required it). So that line is changed to:

$this->Security->requireSecure('*');

By doing so, I ensure that the form is submitted from a page with SSL enabled (as it automatically redirects me) and the security component is happy, the redirection doesn’t happen and therefore our data is intact.

And we’re done.