X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits%2FCatalyst-Manual.git;a=blobdiff_plain;f=lib%2FCatalyst%2FManual%2FTutorial%2FAuthentication.pod;fp=lib%2FCatalyst%2FManual%2FTutorial%2FAuthentication.pod;h=aa77c9c778b7d4f9597bb142fa9a6f7ea68766ad;hp=f3eaa8493668cb7a6965f475b532f60aa4740de9;hb=636ba9f78f6ce788549fbfa7f1a1507d0579e978;hpb=554908172d7b73d43084ac283bb2dad6c7283e92 diff --git a/lib/Catalyst/Manual/Tutorial/Authentication.pod b/lib/Catalyst/Manual/Tutorial/Authentication.pod index f3eaa84..aa77c9c 100644 --- a/lib/Catalyst/Manual/Tutorial/Authentication.pod +++ b/lib/Catalyst/Manual/Tutorial/Authentication.pod @@ -154,14 +154,14 @@ C: # # Set relationships: # - + # has_many(): # args: # 1) Name of relationship, DBIC will create accessor with this name # 2) Name of the model class referenced by this relationship # 3) Column name in *foreign* table (aka, foreign key in peer table) __PACKAGE__->has_many(map_user_role => 'MyApp::Schema::Result::UserRoles', 'user_id'); - + # many_to_many(): # args: # 1) Name of relationship, DBIC will create accessor with this name @@ -176,7 +176,7 @@ C: # # Set relationships: # - + # has_many(): # args: # 1) Name of relationship, DBIC will create accessor with this name @@ -190,14 +190,14 @@ C: # # Set relationships: # - + # belongs_to(): # args: # 1) Name of relationship, DBIC will create accessor with this name # 2) Name of the model class referenced by this relationship # 3) Column name in *this* table __PACKAGE__->belongs_to(user => 'MyApp::Schema::Result::Users', 'user_id'); - + # belongs_to(): # args: # 1) Name of relationship, DBIC will create accessor with this name @@ -210,10 +210,10 @@ The code for these three sets of updates is obviously very similar to the edits we made to the C, C, and C classes created in Part 3. -Note that we do not need to make any change to the -C schema file. It simply tells DBIC to load all -of the Result Class and ResultSet Class files it finds in below the -C directory, so it will automatically pick up our +Note that we do not need to make any change to the +C schema file. It simply tells DBIC to load all +of the Result Class and ResultSet Class files it finds in below the +C directory, so it will automatically pick up our new table information. @@ -258,18 +258,18 @@ C is new): use Catalyst qw/-Debug ConfigLoader Static::Simple - + StackTrace - + Authentication - + Session Session::Store::FastMmap Session::State::Cookie /; -B As discussed in MoreCatalystBasics, different versions of -C have used a variety of methods to load the plugins. +B As discussed in MoreCatalystBasics, different versions of +C have used a variety of methods to load the plugins. You can put the plugins in the C statement if you prefer. The C plugin supports Authentication while the @@ -296,22 +296,22 @@ backed session store). =head2 Configure Authentication -Although C<__PACKAGE__-Econfig(name =E 'value');> is still -supported, newer Catalyst applications tend to place all configuration -information in C and automatically load this information -into Cconfig> using the +Although C<__PACKAGE__-Econfig(name =E 'value');> is still +supported, newer Catalyst applications tend to place all configuration +information in C and automatically load this information +into Cconfig> using the L plugin. -As discussed in Part 3 of the tutorial, Catalyst has recently -switched from a default config file format of YAML to -L (an apache-like format). In case -you are using a version of Catalyst earlier than v5.7014, delete the -C, or convert it to .conf format using the TIP in -L -then simply follow the directions below to create a new C +As discussed in Part 3 of the tutorial, Catalyst has recently +switched from a default config file format of YAML to +L (an apache-like format). In case +you are using a version of Catalyst earlier than v5.7014, delete the +C, or convert it to .conf format using the TIP in +L +then simply follow the directions below to create a new C file. Although we will use the C format here because -YAML files can be difficult to cut and paste in certain environments, -you are free to use any format supported by +YAML files can be difficult to cut and paste in certain environments, +you are free to use any format supported by L and L -- Catalyst will transparently handle the different formats. @@ -346,7 +346,7 @@ C file and update it to match: class DBIx::Class # This is the model object created by Catalyst::Model::DBIC # from your schema (you created 'MyApp::Schema::Result::User' - # but as the Catalyst startup debug messages show, it was + # but as the Catalyst startup debug messages show, it was # loaded as 'MyApp::Model::DB::Users'). # NOTE: Omit 'MyApp::Model' here just as you would when using # '$c->model("DB::Users)' @@ -366,30 +366,30 @@ Use the Catalyst create script to create two stub controller files: $ script/myapp_create.pl controller Login $ script/myapp_create.pl controller Logout -You could easily use a single controller here. For example, you could -have a C controller with both C and C actions. -Remember, Catalyst is designed to be very flexible, and leaves such +You could easily use a single controller here. For example, you could +have a C controller with both C and C actions. +Remember, Catalyst is designed to be very flexible, and leaves such matters up to you, the designer and programmer. -Then open C, locate the -C method (or C if you -are using an older version of Catalyst) that was automatically -inserted by the helpers when we created the Login controller above, +Then open C, locate the +C method (or C if you +are using an older version of Catalyst) that was automatically +inserted by the helpers when we created the Login controller above, and update the definition of C to match: =head2 index - + Login logic - + =cut - + sub index :Path :Args(0) { my ($self, $c) = @_; - + # Get the username and password from form my $username = $c->request->params->{username} || ""; my $password = $c->request->params->{password} || ""; - + # If the username and password values were found in form if ($username && $password) { # Attempt to log the user in @@ -404,7 +404,7 @@ and update the definition of C to match: $c->stash->{error_msg} = "Bad username or password."; } } - + # If either of above don't work out, send to the login page $c->stash->{template} = 'login.tt2'; } @@ -416,10 +416,10 @@ will stay at the login page and receive an error message. If the C and C values are not present in the form, the user will be taken to the empty login form. -Note that we could have used something like "C", -however, it is generally recommended (partly for historical reasons, -and partly for code clarity) only to use C in -C, and then mainly to generate the 404 not +Note that we could have used something like "C", +however, it is generally recommended (partly for historical reasons, +and partly for code clarity) only to use C in +C, and then mainly to generate the 404 not found page for the application. Instead, we are using "C" here to @@ -437,17 +437,17 @@ Next, update the corresponding method in C to match: =head2 index - + Logout logic - + =cut - + sub index :Path :Args(0) { my ($self, $c) = @_; - + # Clear the user's state $c->logout; - + # Send the user to the starting point $c->response->redirect($c->uri_for('/')); } @@ -462,7 +462,7 @@ line of the C. Create a login form by opening C and inserting: [% META title = 'Login' %] - +
@@ -494,17 +494,17 @@ Edit the existing C class file and insert the following method: =head2 auto - + Check if there is a user and, if not, forward to login page - + =cut - + # Note that 'auto' runs after 'begin' but before your actions and that # 'auto's "chain" (all from application path to most specific class are run) # See the 'Actions' section of 'Catalyst::Manual::Intro' for more info. sub auto : Private { my ($self, $c) = @_; - + # Allow unauthenticated users to reach the login page. This # allows unauthenticated users to reach any action in the Login # controller. To lock it down to a single action, we could use: @@ -514,7 +514,7 @@ the following method: if ($c->controller eq $c->controller('Login')) { return 1; } - + # If a user doesn't exist, force login if (!$c->user_exists) { # Dump a log message to the development server debug output @@ -524,18 +524,18 @@ the following method: # Return 0 to cancel 'post-auto' processing and prevent use of application return 0; } - + # User found, so return 1 to continue with processing after this 'auto' return 1; } -As discussed in -L, -every C method from the application/root controller down to the -most specific controller will be called. By placing the -authentication enforcement code inside the C method of -C (or C), it will be -called for I request that is received by the entire +As discussed in +L, +every C method from the application/root controller down to the +most specific controller will be called. By placing the +authentication enforcement code inside the C method of +C (or C), it will be +called for I request that is received by the entire application. @@ -581,9 +581,9 @@ running) and restart it: $ script/myapp_server.pl -B If you are having issues with authentication on -Internet Explorer, be sure to check the system clocks on both your -server and client machines. Internet Explorer is very picky about +B If you are having issues with authentication on +Internet Explorer, be sure to check the system clocks on both your +server and client machines. Internet Explorer is very picky about timestamps for cookies. You can quickly sync a Debian system by installing the "ntpdate" package: @@ -597,17 +597,17 @@ Or, depending on your firewall configuration: sudo ntpdate-debian -u -Note: NTP can be a little more finicky about firewalls because it uses +Note: NTP can be a little more finicky about firewalls because it uses UDP vs. the more common TCP that you see with most Internet protocols. Worse case, you might have to manually set the time on your development box instead of using NTP. -Now trying going to L and you should -be redirected to the login page, hitting Shift+Reload or Ctrl+Reload -if necessary (the "You are already logged in" message should I -appear -- if it does, click the C button and try again). Note -the C<***Root::auto User not found...> debug message in the -development server output. Enter username C and password +Now trying going to L and you should +be redirected to the login page, hitting Shift+Reload or Ctrl+Reload +if necessary (the "You are already logged in" message should I +appear -- if it does, click the C button and try again). Note +the C<***Root::auto User not found...> debug message in the +development server output. Enter username C and password C, and you should be taken to the Book List page. Open C and add the following lines to the @@ -643,7 +643,7 @@ just avoiding the I of cleartext passwords in the database by using a SHA-1 hash. If you are concerned about cleartext passwords between the browser and your application, consider using SSL/TLS, made easy with the Catalyst plugin Catalyst::Plugin:RequireSSL. You should -also consider adding a "salt" mechanism to your hashed passwords to +also consider adding a "salt" mechanism to your hashed passwords to mitigate the risk of a "rainbow table" crack against your passwords (see L for more information on using a salt value). @@ -685,7 +685,7 @@ Then use the following command to update the SQLite database: $ sqlite3 myapp.db < myapp03.sql -B We are using SHA-1 hashes here, but many other hashing +B We are using SHA-1 hashes here, but many other hashing algorithms are supported. See C for more information. @@ -722,7 +722,7 @@ C are new, everything else is the same): class DBIx::Class # This is the model object created by Catalyst::Model::DBIC # from your schema (you created 'MyApp::Schema::Result::User' - # but as the Catalyst startup debug messages show, it was + # but as the Catalyst startup debug messages show, it was # loaded as 'MyApp::Model::DB::Users'). # NOTE: Omit 'MyApp::Model' here just as you would when using # '$c->model("DB::Users)' @@ -747,8 +747,8 @@ login as before. When done, click the "logout" link on the login page =head1 USING THE SESSION FOR FLASH -As discussed in Part 3 of the tutorial, C allows you to set -variables in a way that is very similar to C, but it will +As discussed in the previous part of the tutorial, C allows you to +set variables in a way that is very similar to C, but it will remain set across multiple requests. Once the value is read, it is cleared (unless reset). Although C has nothing to do with authentication, it does leverage the same session plugins. Now that @@ -762,21 +762,21 @@ to match the following (everything after the model search line of code has changed): =head2 delete - + Delete a book - + =cut - + sub delete :Chained('object') :PathPart('delete') :Args(0) { my ($self, $c) = @_; - + # Use the book object saved by 'object' and delete it along # with related 'book_authors' entries $c->stash->{object}->delete; - + # Use 'flash' to save information across requests until it's read $c->flash->{status_msg} = "Book deleted"; - + # Redirect the user back to the list page $c->response->redirect($c->uri_for($self->action_for('list'))); } @@ -794,18 +794,18 @@ flash vs. the C query parameter: ... -Although the sample above only shows the C div, leave the +Although the sample above only shows the C div, leave the rest of the file intact -- the only change we made to the C -was to add "C<|| c.request.params.status_msg>" to the +was to add "C<|| c.request.params.status_msg>" to the Cspan class="message"E> line. =head2 Try Out Flash -Restart the development server, log in, and then point your browser to -L to create an extra -several books. Click the "Return to list" link and delete one of the -"Test" books you just added. The C mechanism should retain our +Restart the development server, log in, and then point your browser to +L to create an extra +several books. Click the "Return to list" link and delete one of the +"Test" books you just added. The C mechanism should retain our "Book deleted" status message across the redirect. B While C will save information across multiple requests, @@ -819,7 +819,7 @@ information. =head2 Switch To Flash-To-Stash -Although the a use of flash above works well, the +Although the a use of flash above works well, the C statement is a little ugly. A nice alternative is to use the C feature that automatically copies the content of flash to stash. This makes your controller