HyperAdmin - Revision history

Woozle: /* Activity tables */

2005-08-15T21:11:28Z

Activity tables

← Older revision		Revision as of 21:11, 15 August 2005
Line 135:		Line 135:

	===Activity tables===		===Activity tables===
	*'''sessions~~''' --~~ shopping [[HyperAdmin Session\|session]]s		====sessions====
			shopping [[HyperAdmin Session\|session]]s
	{\| style="background: #eeeeee;"		{\| style="background: #eeeeee;"
	\|-		\|-
Line 164:		Line 165:
	*if same user connects with new session, any existing sessions are automatically deactivated		*if same user connects with new session, any existing sessions are automatically deactivated
	*sessions.WhenExpired can be NULL even after WhenExpires ''if'' session is never accessed after WhenExpires and same user does not ever reconnect		*sessions.WhenExpired can be NULL even after WhenExpires ''if'' session is never accessed after WhenExpires and same user does not ever reconnect
			====events====
	*'''events''' -- logs of login attempts as well as what users did while logged in		logs of login attempts as well as what users did while logged in
	{\| style="background: #eeeeff;"		{\| style="background: #eeeeff;"
	\|-		\|-

Woozle: /* Activity tables */ rules

2005-08-15T21:10:01Z

Activity tables: rules

← Older revision		Revision as of 21:10, 15 August 2005
Line 140:		Line 140:
	\|K#\|\|'''ID''' \|\| int(4)		\|K#\|\|'''ID''' \|\| int(4)
	\|-		\|-
	\|\|\|'''Cookie''' \|\| text \|\| session-ID cookie (at least 32 bits of random data)		\|\|\|'''Cookie''' \|\| text \|\| session-ID cookie (at least <s>32</s> 128 bits of random data)
			\|-
			\|\|\|'''User''' \|\| int(4) \|\| users.ID of authenticated user (logged in with password); NULL = no user, or not authenticated
	\|-		\|-
	\|\|\|'''Remote_Client''' \|\| text \|\| browser user_agent string		\|\|\|'''Remote_Client''' \|\| text \|\| browser user_agent string
Line 148:		Line 150:
	\|\|\|'''Remote_Addr''' \|\| int(4) \|\| remote host IP address		\|\|\|'''Remote_Addr''' \|\| int(4) \|\| remote host IP address
	\|-		\|-
	\|\|\|'''Remote_Key''' \|\| text \|\| remote address or host domain plus user_agent - for quick ~~searching~~		\|\|\|'''Remote_Key''' \|\| text \|\| remote address or host domain plus user_agent - for quick search of userless sessions
	\|-		\|-
	\|\|\|'''WhenStarted''' \|\| timestamp \|\| when session was started		\|\|\|'''WhenStarted''' \|\| timestamp \|\| when session was started
Line 156:		Line 158:
	\|\|\|'''WhenExpires''' \|\| timestamp \|\| when this session will expire; NULL=never (see [[HyperAdmin Session]]s)		\|\|\|'''WhenExpires''' \|\| timestamp \|\| when this session will expire; NULL=never (see [[HyperAdmin Session]]s)
	\|-		\|-
	\|\|\|'''~~IsActive~~''' \|\| ~~flag~~ \|\| ~~marked TRUE~~ when session ~~is created, marked FALSE when session expires~~		\|\|\|'''WhenExpired''' \|\| timestamp \|\| when this session was actually expired (see Rules below)
	\|}		\|}

			'''Rules''':
			*if same user connects with new session, any existing sessions are automatically deactivated
			*sessions.WhenExpired can be NULL even after WhenExpires ''if'' session is never accessed after WhenExpires and same user does not ever reconnect

	*'''events''' -- logs of login attempts as well as what users did while logged in		*'''events''' -- logs of login attempts as well as what users did while logged in

Woozle: /* Activity tables */ "log" -> "events"; added "events.Type" field

2005-08-15T20:06:49Z

Activity tables: "log" -> "events"; added "events.Type" field

← Older revision		Revision as of 20:06, 15 August 2005
Line 159:		Line 159:
	\|}		\|}

	*'''~~log~~''' -- logs of login attempts as well as what users did while logged in		*'''events''' -- logs of login attempts as well as what users did while logged in
	{\| style="background: #eeeeff;"		{\| style="background: #eeeeff;"
	\|-		\|-
Line 171:		Line 171:
	\|-		\|-
	\|\|\|'''Seq''' \|\| int(4) \|\| Order in which actions were executed, if done at the same time		\|\|\|'''Seq''' \|\| int(4) \|\| Order in which actions were executed, if done at the same time
			\|-
			\|\|\| '''Type''' \|\| text(8) \|\| short code for event type - [event_types] table (to be designed)
	\|-		\|-
	\|\|\|'''Descr''' \|\| text \|\| description of action taken (should be very specific)		\|\|\|'''Descr''' \|\| text \|\| description of action taken (should be very specific)
	\|}		\|}

Woozle: /* Activity tables */

2005-08-15T19:40:48Z

Activity tables

← Older revision		Revision as of 19:40, 15 August 2005
Line 138:		Line 138:
	{\| style="background: #eeeeee;"		{\| style="background: #eeeeee;"
	\|-		\|-
	\| '''ID'''#@ \|\| int(4)		\|K#\|\|'''ID''' \|\| int(4)
	\|-		\|-
	\| '''Cookie''' \|\| text \|\| session-ID cookie (at least 32 bits of random data)		\|\|\|'''Cookie''' \|\| text \|\| session-ID cookie (at least 32 bits of random data)
	\|-		\|-
	\|'''Remote_Client''' \|\| text \|\| browser user_agent string		\|\|\|'''Remote_Client''' \|\| text \|\| browser user_agent string
	\|-		\|-
	\|'''Remote_Host''' \|\| text \|\| remote host domain info (reverse lookup), if any		\|\|\|'''Remote_Host''' \|\| text \|\| remote host domain info (reverse lookup), if any
	\|-		\|-
	\|'''Remote_Addr''' \|\| int(4) \|\| remote host IP address		\|\|\|'''Remote_Addr''' \|\| int(4) \|\| remote host IP address
	\|-		\|-
	\|'''Remote_Key''' \|\| text \|\| remote address or host domain plus user_agent - for quick searching		\|\|\|'''Remote_Key''' \|\| text \|\| remote address or host domain plus user_agent - for quick searching
	\|-		\|-
	\|'''WhenStarted''' \|\| timestamp \|\| when session was started		\|\|\|'''WhenStarted''' \|\| timestamp \|\| when session was started
	\|-		\|-
	\|'''WhenLastAct''' \|\| timestamp \|\| timestamp of last activity on this session		\|\|\|'''WhenLastAct''' \|\| timestamp \|\| timestamp of last activity on this session
	\|-		\|-
	\|'''WhenExpires''' \|\| timestamp \|\| when this session will expire; NULL=never (see [[HyperAdmin Session]]s)		\|\|\|'''WhenExpires''' \|\| timestamp \|\| when this session will expire; NULL=never (see [[HyperAdmin Session]]s)
	\|-		\|-
	\|'''IsActive''' \|\| flag \|\| marked TRUE when session is created, marked FALSE when session expires		\|\|\|'''IsActive''' \|\| flag \|\| marked TRUE when session is created, marked FALSE when session expires
	\|}		\|}

Woozle: /* Logging tables */

2005-08-15T19:36:49Z

Logging tables

@@ Line 134: / Line 134: @@
 |}
-===Logging tables===
+===Activity tables===
 *'''log''' -- logs of login attempts as well as what users did while logged in
 {| style="background: #eeeeff;"

Woozle: /* Flow chart */ changed user+pw to session key; Notes section; some extra checks

2005-08-15T15:08:23Z

Flow chart: changed user+pw to session key; Notes section; some extra checks

← Older revision		Revision as of 15:08, 15 August 2005
Line 14:		Line 14:
	*# Get user form input (user, pass, possibly extra pass & email)		*# Get user form input (user, pass, possibly extra pass & email)
	*# If no user given:		*# If no user given:
	# check cookies for ~~user/pass combination:~~		# check cookies for session key
	#* If ~~user/pass~~ found in cookies~~, set~~ $~~is_revisit~~ flag		#* If session key found in cookies:
	#* If no ~~user/pass~~ found in cookies:		#** If session is active and valid:
			#*** Set $login_ok flag
			#** ...else (session invalid or expired):
			#*** Set login message to "invalid or expired session; please log in"
			#*** Set $do_login_screen flag
			#* If no session key found in cookies:
	#** set $do_login_screen flag		#** set $do_login_screen flag
	#**set login message to "Please log in"		#**set login message to "Please log in"
Line 38:		Line 43:
	#* Set login message to "you are the first user; please create a new account"		#* Set login message to "you are the first user; please create a new account"
	*# ...else if users found:		*# ...else if users found:
			# If user matches existing username, set $do_login_attempt flag
	# If $do_login_attempt:		# If $do_login_attempt:
	#* Lookup encrypted password for given user		#* Lookup encrypted password for given user
Line 66:		Line 72:
	*Can $do_login_screen and $login_ok both end up false? In this case, nothing would be displayed.		*Can $do_login_screen and $login_ok both end up false? In this case, nothing would be displayed.
	*Can $do_login_screen and $login_ok both end up true? Is the resulting behavior appropriate?		*Can $do_login_screen and $login_ok both end up true? Is the resulting behavior appropriate?
			==Notes==
			"Session key" could be dumbed down to just username+password sent in a single parameter, if proper sessions were not otherwise needed for a site, though sessions do provide better security even if they aren't used for anything else.

	==Tables==		==Tables==

Woozle: /* Flow chart */ flow revisions

2005-08-08T18:22:02Z

Flow chart: flow revisions

← Older revision		Revision as of 18:22, 8 August 2005
Line 45:		Line 45:
	#* ...else (password mismatch):		#* ...else (password mismatch):
	#** increment login attempts for this user		#** increment login attempts for this user
			#** set login message to "invalid user/password"
			#** if $is_revisit, log a HACK WARNING
	# ...else (not $do_login_attempt):		# ...else (not $do_login_attempt):
	#* If $new_pass_valid:		#* If $new_pass_valid:
Line 51:		Line 53:
	#* ...else (not $new_pass_valid):		#* ...else (not $new_pass_valid):
	#** set $do_login_screen flag		#** set $do_login_screen flag
	#** set login message to "invalid user/password"
	#** if $is_revisit, log a HACK WARNING
	*'''Phase III''': set cookies and show html		*'''Phase III''': set cookies and show html
	*# if $do_login_screen:		*# if $do_login_screen:
Line 63:		Line 63:
	#* Number of failed login attempts		#* Number of failed login attempts

	Possible ~~bugs~~:		Possible security holes:
	*Can $do_login_screen and $login_ok both end up false? In this case, nothing would be displayed.		*Can $do_login_screen and $login_ok both end up false? In this case, nothing would be displayed.
	*Can $do_login_screen and $login_ok both end up true? Is the resulting behavior appropriate?		*Can $do_login_screen and $login_ok both end up true? Is the resulting behavior appropriate?

Woozle: set user/pass cookie

2005-08-08T16:41:55Z

set user/pass cookie

← Older revision		Revision as of 16:41, 8 August 2005
Line 57:		Line 57:
	# Show login screen, login message, and # of login attempts for this user		# Show login screen, login message, and # of login attempts for this user
	*# ...else if $login_ok		*# ...else if $login_ok
			# Set user/pass cookie
	# Show control bar, with appropriate applications enabled and user info:		# Show control bar, with appropriate applications enabled and user info:
	#* Time of last successful login		#* Time of last successful login

Woozle: /* Flow chart */

2005-08-08T16:41:06Z

Flow chart

← Older revision		Revision as of 16:41, 8 August 2005
Line 14:		Line 14:
	*# Get user form input (user, pass, possibly extra pass & email)		*# Get user form input (user, pass, possibly extra pass & email)
	*# If no user given:		*# If no user given:
	# set $is_old_user flag
	# check cookies for user/pass combination:		# check cookies for user/pass combination:
	#* If user/pass found in cookies, set $~~is_old_user~~ flag		#* If user/pass found in cookies, set $is_revisit flag
	#* If no user/pass found in cookies:		#* If no user/pass found in cookies:
	#** set $do_login_screen flag		#** set $do_login_screen flag
Line 41:		Line 40:
	# If $do_login_attempt:		# If $do_login_attempt:
	#* Lookup encrypted password for given user		#* Lookup encrypted password for given user
	#* If encryption of new password matches, set $login_ok flag		#* If encryption of new password matches
			#** set $login_ok flag
			#** if previous login was successful (check timestamps), set login attempts to zero
			#* ...else (password mismatch):
			#** increment login attempts for this user
	# ...else (not $do_login_attempt):		# ...else (not $do_login_attempt):
	#* If $new_pass_valid:		#* If $new_pass_valid:
Line 49:		Line 52:
	#** set $do_login_screen flag		#** set $do_login_screen flag
	#** set login message to "invalid user/password"		#** set login message to "invalid user/password"
			#** if $is_revisit, log a HACK WARNING
	*'''Phase III''': set cookies and show html		*'''Phase III''': set cookies and show html
	*# if $do_login_screen:		*# if $do_login_screen:
	# Show login screen and login ~~message~~		# Show login screen, login message, and # of login attempts for this user
	*# ...else if $login_ok		*# ...else if $login_ok
	# Show control bar, with appropriate applications enabled		# Show control bar, with appropriate applications enabled and user info:
			#* Time of last successful login
			#* Time of last unsuccessful login
			#* Number of failed login attempts

	Possible bugs:		Possible bugs:

Woozle: /* Login Sequence */

2005-08-08T16:23:47Z

← Older revision		Revision as of 16:23, 8 August 2005
Line 5:		Line 5:

	==Login Sequence==		==Login Sequence==
	# Get user input (user, pass, possibly extra pass & email)
	# If no user given:		===Major phases===
	## set $is_old_user flag		#check what came in (form/cookies); set flags
	## check cookies for user/pass combination:		#inspect the database; set flags
	### If user/pass found in cookies, set $is_old_user flag		#set cookies and show html
	### If no user/pass found in cookies, set $do_login_screen flag		===Flow chart===
	# ...else if user given:		*'''Phase I''': check what came in
	## If password also given		*# Get user form input (user, pass, possibly extra pass & email)
	### If 2 passwords match set $~~new_pass_valid~~ flag		*# If no user given:
	### If 2 passwords don't match, set $do_login_screen flag		# set $is_old_user flag
	# Open database and inspect "users" table.		# check cookies for user/pass combination:
	# If no users yet:		#* If user/pass found in cookies, set $is_old_user flag
	## ~~set~~ $~~is_first_user~~ flag		#* If no user/pass found in cookies:
	# ...else if users found:		#** set $do_login_screen flag
	(~~in progress~~)		#**set login message to "Please log in"
	## If $new_pass_valid:		*# ...else (user given):
	### Create new account		# If password also given
			#* If 2nd password given:
			#** If 2 passwords match set $do_create_user flag
			#** If 2 passwords don't match:
			#*** set $do_login_screen flag
			#*** set login message to "passwords don't match"
			#** ...else (no 2nd password):
			#*** set $do_login_attempt flag
			*'''Phase II''': check database
			*# Open database and inspect "users" table.
			*# If no users yet:
			# If $do_create_user:
			#* Add user to database
			#* Give user "god" permissions
			#* Set $login_ok flag
			# ...else (not $do_create_user):
			#* Set login message to "you are the first user; please create a new account"
			*# ...else if users found:
			# If $do_login_attempt:
			#* Lookup encrypted password for given user
			#* If encryption of new password matches, set $login_ok flag
			# ...else (not $do_login_attempt):
			#* If $new_pass_valid:
			#** Create new account
			#** Set $login_ok flag
			#* ...else (not $new_pass_valid):
			#** set $do_login_screen flag
			#** set login message to "invalid user/password"
			*'''Phase III''': set cookies and show html
			*# if $do_login_screen:
			# Show login screen and login message
			*# ...else if $login_ok
			# Show control bar, with appropriate applications enabled

			Possible bugs:
			*Can $do_login_screen and $login_ok both end up false? In this case, nothing would be displayed.
			*Can $do_login_screen and $login_ok both end up true? Is the resulting behavior appropriate?

	==Tables==		==Tables==
	*"K" indicates Primary Key fields		*"K" indicates Primary Key fields

← Older revision		Revision as of 16:41, 8 August 2005
Line 57:		Line 57:
	# Show login screen, login message, and # of login attempts for this user		# Show login screen, login message, and # of login attempts for this user
	*# ...else if $login_ok		*# ...else if $login_ok
			# Set user/pass cookie
	# Show control bar, with appropriate applications enabled and user info:		# Show control bar, with appropriate applications enabled and user info:
	#* Time of last successful login		#* Time of last successful login

← Older revision		Revision as of 16:41, 8 August 2005
Line 14:		Line 14:
	*# Get user form input (user, pass, possibly extra pass & email)		*# Get user form input (user, pass, possibly extra pass & email)
	*# If no user given:		*# If no user given:
	# set $is_old_user flag
	# check cookies for user/pass combination:		# check cookies for user/pass combination:
	#* If user/pass found in cookies, set $~~is_old_user~~ flag		#* If user/pass found in cookies, set $is_revisit flag
	#* If no user/pass found in cookies:		#* If no user/pass found in cookies:
	#** set $do_login_screen flag		#** set $do_login_screen flag
Line 41:		Line 40:
	# If $do_login_attempt:		# If $do_login_attempt:
	#* Lookup encrypted password for given user		#* Lookup encrypted password for given user
	#* If encryption of new password matches, set $login_ok flag		#* If encryption of new password matches
			#** set $login_ok flag
			#** if previous login was successful (check timestamps), set login attempts to zero
			#* ...else (password mismatch):
			#** increment login attempts for this user
	# ...else (not $do_login_attempt):		# ...else (not $do_login_attempt):
	#* If $new_pass_valid:		#* If $new_pass_valid:
Line 49:		Line 52:
	#** set $do_login_screen flag		#** set $do_login_screen flag
	#** set login message to "invalid user/password"		#** set login message to "invalid user/password"
			#** if $is_revisit, log a HACK WARNING
	*'''Phase III''': set cookies and show html		*'''Phase III''': set cookies and show html
	*# if $do_login_screen:		*# if $do_login_screen:
	# Show login screen and login ~~message~~		# Show login screen, login message, and # of login attempts for this user
	*# ...else if $login_ok		*# ...else if $login_ok
	# Show control bar, with appropriate applications enabled		# Show control bar, with appropriate applications enabled and user info:
			#* Time of last successful login
			#* Time of last unsuccessful login
			#* Number of failed login attempts

	Possible bugs:		Possible bugs: