diff --git a/SUMMARY.md b/SUMMARY.md index 03e319b..ab72b18 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -40,7 +40,6 @@ * [Logging](services/logging.md) * [Localization](services/localization.md) * [Events](services/events.md) -* [Action Manager](services/action_manager.md) * [Tasks](services/tasks.md) * [Queues](services/queues.md) * [Collection](services/collection.md) diff --git a/basics/requests.md b/basics/requests.md index af836b9..3833a64 100644 --- a/basics/requests.md +++ b/basics/requests.md @@ -4,19 +4,7 @@ Requests can be either incoming requests such as http requests on the server sid ## Http Requests -Every request accepts a localization for localized responses, optionally the request URI can also be passed during initialization. - -``` -$request = new Request(new Localization(), new Http()); -``` - -In case no URI is provided the request object initializes the current http request URI. The request object automatically removes all global request variables (e.g. $_GET) in case the current http request gets initialized. All the data will be available through: - -``` -$request->getData('queryName'); -``` - -During the request initialization the UriBuilder will be set up as well. +## Rest Requests ## Socket Requests diff --git a/basics/routing.md b/basics/routing.md index dbc0bfa..0f05e27 100644 --- a/basics/routing.md +++ b/basics/routing.md @@ -41,7 +41,7 @@ $this->router->add('foo/bar', function() { ## Route Parameters -coming soon + ## Reference diff --git a/basics/views.md b/basics/views.md index 123c41c..bd2262e 100644 --- a/basics/views.md +++ b/basics/views.md @@ -12,7 +12,7 @@ In case the response header is set to JSON the view will automatically get parse The base view class contains the request as well as the response objects hence it also contains the request/response localization. One of the most important methods is the `getText()` method. This private method allows for module and theme specific translations of defined language elements. -In the template you can simply use `$this->getHtml({TEXT_ID})` for localized text. All other localization elements can be accessed in a similar way e.g. `$this->l11n->getTemperature()` +In the template you can simply use `$this->getText({TEXT_ID})` for localized text. All other localization elements can be accessed in a similar way e.g. `$this->l11n->getTemperature()` ## Templates diff --git a/components/modules.md b/components/modules.md index ea18288..4fd5a89 100644 --- a/components/modules.md +++ b/components/modules.md @@ -68,9 +68,9 @@ class Installer extends InstallerAbstract { public static function install(string $path, Pool $dbPool, InfoManager $info) { - parent::install(__DIR__ . '/..', $dbPool, $info); + parent::install($path, $dbPool, $info); - switch ($dbPool->get()->getType()) { + switch ($dbPool->get('core')->getType()) { case DatabaseType::MYSQL: /* Your database setup goes here */ break; diff --git a/components/packages.md b/components/packages.md new file mode 100644 index 0000000..bb68b86 --- /dev/null +++ b/components/packages.md @@ -0,0 +1,42 @@ +# Updates + +The following directory structure shows how a update/patch package has to be structured.The purpose of the different files will be +covered afterwards. + +* {UniquePackageName.tar.gz} + * signature.cert + * Files + * package.json + * {other_files_or_subdirectories} + +## Package Name + +The unique package name is generated by the update server. Usually they are called: + +* Modules: {Module Name}_{New Version}.tar.gz +* Framework: {Framework Name}_{New Version}.tar.gz +* Resources: {Resource Name}_{New Version}.tar.gz +* Other Components: {Component Name}_{New Version}.tar.gz + +By providing unique package names it's possible to define other updates as dependencies and prevent overwriting update packages. + +## signature.cert + +The `signature.cert` contains the signature for the package which will be used to certify the origin of the package. +The public key provided with the application is used to decrypt the certificate and compare it to the actual package data. + +## Files + +In the files directory all files are stored. + +### package.json + +The `package.json` file contains information of the package. + +``` +``` + +### Other + +All other files are related to updates, patches, extensions and installation. These files can be simple assets that will be used or +replaced in modules, classes in the framework that need to be updated and sql methods for updateing the database schema. diff --git a/cover.jpg b/cover.jpg index fa722ee..5deadf7 100644 Binary files a/cover.jpg and b/cover.jpg differ diff --git a/datastorage/cache.md b/datastorage/cache.md index b6d762b..378eb61 100644 --- a/datastorage/cache.md +++ b/datastorage/cache.md @@ -1,8 +1,8 @@ -# Cache +## Cache For caching the `CacheManager` provides access to the caching systems in place. Out of the box the CacheManager supports and automatically initializes either Redis or Memcached depending on the client configuration. The caching is not mandatory and therfor shouldn't be missuesed as in-memory database. It is not necessary to check if Redis or Memcached are available the CacheManager automatically handles the caching based on their existence. -## HTTP Cache +### HTTP Cache By default only stylesheets, javascript and layout images as well as module images are cached. Everything else is considered volatile and not cached. If a response specific response should be cached feel free to use the response header: @@ -18,12 +18,4 @@ Example usage: ``` $head->addAsset(AssetType::JS, $request->getUri()->getBase() . 'Modules/Media/Controller.js?v=' . self::MODULE_VERSION); -``` - -## FileCache - -The `FileCache` provides file caching of data on a single file basis. Every cache object will be stored in a sperate file on the local file system. The file cache doesn't support remote caching. The `FileCache` serializes and unserializes the data/object by invoking the corresponding serialization and unserialization functions. Scalars and array will be handled by the cache internally. - -### Storage - -The cache key used will be used for the file storage. Invalid path characters used within the cache key will be replaced. The character `/` used inside the key string can be used to generate subdirectories in the cache directory. \ No newline at end of file +``` \ No newline at end of file diff --git a/math/forecasting.md b/math/forecasting.md index dbb6771..e69de29 100644 --- a/math/forecasting.md +++ b/math/forecasting.md @@ -1,6 +0,0 @@ -# Forecasting - -## Exponential Smoothing - -### Double Exponential Smoothing (Holt) - diff --git a/quality/tests.md b/quality/tests.md index a45d683..1ea7d49 100644 --- a/quality/tests.md +++ b/quality/tests.md @@ -1,6 +1,6 @@ # Tests -The applications goal is to achive 90% code coverage, which applies for the core application as well as all modules. All unit tests are located in a separate repository `Tests`. The frameworks code coverage has to be greater than 75% at all times. +The applications goal is to achive 90% code coverage, which applies for the core application as well as all modules. All unit tests are located in a separate repository `Tests`. ## PHPUnit @@ -8,7 +8,7 @@ This application uses PHPUnit as unit testing framework. The PHPUnit directory i ### Modules -Every module needs to have a `Admin` directory containing a class called `AdminTest.php` which is used for testing the installation, activation, deactivation, uninstall and remove of the module. Tests that install, update, remove etc. a module need to have a group called `admin`. After running the `AdminTest.php` test the final state of the module should be installed and active, only this way it's possible to further test the controller and models. A code coverage of 75% is mandatory for every module for integration. +Every module needs to have a `Admin` directory containing a class called `AdminTest.php` which is used for testing the installation, activation, deactivation, uninstall and remove of the module. Tests that install, update, remove etc. a module need to have a group called `admin`. After running the `AdminTest.php` test the final state of the module should be installed and active, only this way it's possible to further test the controller and models. A code coverage of 80% is mandatory for every module for integration. ## Jasmine diff --git a/security/security_guidelines.md b/security/security_guidelines.md index 8cfc5a9..a2da81e 100644 --- a/security/security_guidelines.md +++ b/security/security_guidelines.md @@ -20,11 +20,11 @@ Example usage in a module handling a API request: ``` if($request->getData('CSRF') === null) { - $response->setStatusCode(RequestStatusCode::R_403); - + $response->setStatusCode(RequestStatus::R_403); + /* optional */ $response->set($request->__toString(), new Notify('Unknown referrer!', NotifyType::INFO)); - + return; } ``` @@ -56,13 +56,13 @@ Scripts and frames must be provided by the own server or google. This is importa The default CSP looks like the following: ``` -$response->getHeader()->set('content-security-policy', 'script-src \'self\'; child-src \'self\'', true); +$response->getHeader()->set('content-security-policy', 'script-src \'self\'; frame-src \'self\'', true); ``` -In order to whitelist inline javascript you can use the following logic. This however requires you to know the inline script beforehand `$script`. After setting the CSP header they automatically get locked so that further changes are not possible. This is a security measure in order to prevent any malicious adjustments. +In order to whitelist inline javascript you can use the following logic. This however requires you to know the inline script beforehand `$script`. After setting the CSP header they automatically get locked so that further changes are not possible. This is a security measure in order to prevent any malicious adjustments. ``` -$response->getHeader()->set('content-security-policy', 'script-src \'self\' \'sha256-' . base64_encode(hash('sha256', $script, true)) . '\'; child-src \'self\'', true); +$response->getHeader()->set('content-security-policy', 'script-src \'self\' \'sha256-' . base64_encode(hash('sha256', $script, true)) . '\'; frame-src \'self\'', true); ``` ### X-XSS-Protection @@ -105,7 +105,7 @@ In some cases super globals will even be overwritten by values from these classe Input validation be implemented on multiple levels. 1. Regex validation in html/javascript by using the `pattern=""` attribute -2. Type hints for method parameters and method returns wherever possible. +2. Type hints for method parameters wherever possible. 3. Making use of the `Validation` classes as much as possible 4. **Don't** sanitize at all! Accept or dismiss. @@ -131,9 +131,9 @@ if(($pathNew = realpath($path)) === false || strpos($pathNew, self::MODULE_PATH) The example throws an exception if the path either doesn't exist or is trying to access a path that doesn't contain the path defined in `self::MODULE_PATH`. Another validation could be: ``` -if(($pathNew = realpath($path)) === false || !Validator::startsWith($pathNew, ROOT_PATH)) { +if(($pathNew = realpath($path)) === false || !StringUtils::startsWith($pathNew, ROOT_PATH)) { throw new PathException($path); } ``` -This example now is not only checking if the path exists and if it contains a path element, it also makes sure that the path is inside the application root path. \ No newline at end of file +This example now is not only checking if the path exists and if it contains a path element, it also makes sure that the path is inside the application root path. You could as easily replace `ROOT_PATH` with `self::MODULE_PATH` and this validation would make sure `$path` only directs within a module. \ No newline at end of file diff --git a/services/action_manager.md b/services/action_manager.md deleted file mode 100644 index 5979bb3..0000000 --- a/services/action_manager.md +++ /dev/null @@ -1,79 +0,0 @@ -# Action Manager - -The action manager is only available for the frontend as its purpose is to execute/trigger events based on UI events. The action manager allows to define procedures for UI events without writing any inline JavaScript and reducing the necessary JavaScript code in general thanks to this modular approach. - -## Binding Action Events - -In order to perform actions on UI events it is necessary to define listeners for elements that need to be observed. Usually these elements are input and button elements. The following action has one `click-listener` executing the defined actions if this listener is triggered. - -``` -