Zend_Acl

The package provides classical ACL functionality. There are roles, resources and privileges, and you can assign them to each other via deny and allow rules. For example you can say that XY user(role) is allowed to moderate(privilege) the PHP topic(resource) in a forum. You don’t have to always specify all the three part, for example you can say, that administrator can moderate any topic.

I won’t introduce the Zend_Acl package, it has an easy to understand manual page. Some observation which could be interesting related to this post:

• There is no separate user and group in Zend_Acl, the concept of role includes both of them. A role can have multiple parents, so roles compose a directed graph.
• Resources can have only one parent so they compose a tree.

Zend_Acl limitations/problems

Consider a forum where you have a lot of users/groups and a lot of resources (topics). You have have to add all of them (manually one at a time) to the Acl object which is very memory and time consuming task. Of course once you build the Acl object you can save it (in a serialized form) and reuse it next time but it will eat a lot of memory too. To make this clear check the following code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

You can see that if I want to reference a role or a resource in the allow/deny method, first I have to add it to the Acl object.

My other problem is that the Zend_Acl doesn’t support different type of roles/resources. Of course you can use a prefix, but maybe different roles/resources should be handled in a different way.

I wanted to come up with a solution where I have to define only the access rules and the Acl automatically checks if the referenced entity exists and automatically handles its relations (parent[s]), something like this:

1
2
3
4
5
6
7
8

You may have immeditaley a problem with this code: how can we distinguish the different roles/resources? Yes, we need one more step to have enough felxibility:
$acl = new Zend_Acl();

$acl->deny(‘group:guest’, ‘topic:membersonly’);

echo $acl->isAllowed(‘user:someUser’, ‘topic:membersonly’) ? ‘allowed’ : ‘denied’;
?>
With this notation we can have any type of roles and resources. In a typical application you will have a user and a group roles, but you can have for example an ldapuser too.

Foo_Acl

After a little planning I find out the following structure:

Zend_Acl has a RoleRegistry but I needed more functionality so I extended it. In Zend_Acl there is no ResourceRegistry, so I added to the Foo_Acl package, its functionality is very similar to the RoleRegistry. For both of them I defined an interface, they can handle any role/resource which implements it. This interfaces extends the proper interfaces in the Zend_Acl package, and defines some more basic functionality: getting the relation(s) of the role/resource and loading it. For example the Foo_Acl_Role_Interface is the following:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

The functionality of different roles/resources is very similar, so I created a default implementation for both of this interfaces, and you can easily create custom ones by extending it. The default implementation of the Foo_Acl_Role_Interface is the following:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

If you want to create a custom role you should extend this class and overwrite the load function which responsibility is to check if the specified role exists and to instantiate the proper role object. I wrote some sample custom rules, the following is for representing users:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

You can see it is very straightforward to create a new role. I commented out the caching codes because I am in changing the cache implementations and I could not put it to sample code.

The Foo_Acl package provide an effective and convenient way to handle a huge number of entity:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

I tested it on the database of a bigger forum and it worked very well. You can download the sample code here.

Late static binding basic

First let me introduce what late static binding is about. I am not going to write too much about the basics, because fortunately I get a helping hand . So the base problem is the following:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Static references to the current class like self:: or __CLASS__ are resolved using the class in which the function belongs, as in where it was defined, so when we call the test() method on class B it will call the who() method of class A.

PHP 5.3 introduces a new possibility by allowing a keyword that references the class that was initially called at runtime:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

This is the basic behavior of the static keyword in this context, you can get more information in the manual. Now back to the ActiveRecord.

Facing the problem

Zend’s proposal was something similar:

1
2
3
4
5
6
7
8
9
10
11
12
13

The conception is nice, the base implementation of findByPk() finds out from the name of the child class the name of the table on which it should be operate. There is only one (huge) problem with this code, when findByPk() is called it can’t determines the name of the class on which it was called. There was an ugly workaround using debug_backtrace(), but its performance was quite poor, so finally it was not used in ZF.

After the late static binding introduction you may come up with the following code in PHP 5.3:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

Running this code the value of $calledClass will be “Blog”. This is great, but it would be very annoying if we have to add the getClass() method to every child class. Fortunately with the late static binding we get a great new function too: get_called_class(), which returns the name of the current calling scope. Using this function we get a nifty code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

This works very well, but unfortunately we can’t be absolutely happy, because there is a big flaw (I believe it is) in the current implementation of late static binding. Michael Lively pointed to this problem on the internal list and on his blog. How does this problem affect our example? Imagine that we want a simple logging functionality only in the Blog class. Consider the following code (it seems to a logical and suitable solution for this task):

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

If you try to run this program maybe you will surprise, because the value of the $calledClass variable will be “ActiveRecord”. OOPS! What here happens: parent will resolve to ActiveRecord and this breaks late static binding. From the manual: “Late static bindings’ reslution will stop at a fully resolved static call with no fallback”. It is possible that this explanation is not completely exact (maybe somebody from the internal list can explain it more precisely), but the substance is that this is a legitimate usage of late static binding and is not currently supported. I hope it will be fixed/supported in the final version of PHP 5.3.

I believe that this feature holds a lot of potential, for example you should check Joshua Thompson’s very interesting post: Return to Prototype Based Programming in PHP.

Namespaces basic

Namespace support in PHP was a long-felt want feature. In PHP the main motivation behind adding namespace support to the language was to solve the problem of long class names. If you develop a bigger library, you have to use long class names to avoid naming conflicts, for example look at this monster: Zend_Search_Lucene_Analysis_Analyzer_Common_Text_CaseInsensitive.

From the version 5.3 you can group your code into namespaces. Different namespaces can contains classes, functions, constants with the same name. Defining a namespace is very straightforward, you should use the namespace statement in the very beginning of the file, for example:

1
2
3
4
5
6
7
8
9
10
11
12

You have a lot of options to use items defined in this namespace:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

Only namespaces and classes can be imported with the use statement, for example you can’t say: use my::foo::MY_CONST;. A use statement takes effect from its definition to the end of the file, you can use it everywhere in the global scope. You can use the same namespace in more files, but one file should contain only one namespace (this behavior maybe will changed in the final version, or the maybe the namespace keyword will be replaced with package ). While you can’t import a function or a constant, you should always use some kind of prefix if you want to access any of them from a namespace. In the earlier versions of PHP 5.3 the import keyword was used insted of use, but few weeks ago it was changed.

The “empty” namespace (::)

If you use the :: prefix by function and class names, they are interpreted as global independently from the current import rules. This is useful inside a namespace.

Life with namesapces (porting code to PHP 5.3)

If you decide to use namespaces there are some pitfalls you should pay attention.

Class naming convention

You should forget to use reserved words in you class names. Consider the following code:

1
2
3
4

The equivalent would be this using namespace:

1
2
3
4
5

But DateStatic is a reserved word (and an existent internal class) so this code ends in fatal error. This could be a bad news if you have a lot of similar classes.

Autoloading

From PHP 5.3 __autoload() will get the fully qualified class name. This mean that you have to modify you __autoload funciton if you have used one. A basic example:

1
2
3
4
5
6
7
8
9

Or you prefer the SPL way:

1
2
3
4
5
6
7
8
9

1
2
3

get_class(), get_parent_class(), etc.

When you use these type of functions you should take into consideration that they returns fully qualified class names too.

Reflection API

The Reflection API should reflect (;)) to this new language feature. The plan is the following:

• Create a new ReflectionNamespace class with the following methods: getName(), getClasses(), getFunctions(), getFiles()
• Extend the ReflectionClass and ReflectionFunction classes with a new getNamespace() method.

Life inside a namespace

There is some special knowledge you should be familiar with, if you want to write codes in namespaces.

The __NAMESPACE__ constant

There is a new special constant: __NAMESPACE__, which contains the name of the current namespace. For example you can write the SPL autoloader in the following way:

1
2
3
4
5
6
7
8
9

Resolving names inside a namespace

I don’t want to describe the complete rule set here, you can read it in the PHP namespaces README. The main point is, that PHP try to resolve a name first according to the current namesapce. Let’s see some example:

1
2
3
4
5
6
7

When you call bar() then PHP try to find the function in the my::foo namespace. If it finds it will call it, if not it will try to call the internal bar() function, so it is important to notice, that using this notation, you can’t call user defined function inside a namespace. Using the ::bar() form PHP will call the bar() function in the global namespace, so it could be an internal or a user defined function. This logic is true when you try to create a new object.

1
2
3
4
5
6
7

In this case of core::bar() PHP first tries to call function bar() from namespace my::foo::core then calls method bar() of internal class core. In the case of ::core::bar() it first tries to call function bar() from namespace core then calls method bar() of class core from global scope.

The namespace support in PHP is not yet finished, it is possible some modifications in the future.

To get WordPress to insert the title attribute automatically to a tag we had to modify the wp-includes/js/quicktags.js file by adding a few lines of code to the edInsertTag function at two places:

341
342
343

357
358
359

You can download the fully modified version from here (this file contains my former modifications).

Smarty resources

Smarty supports several type of plug-ins including resource plug-ins. Resource plug-ins allow you to change the way Smarty looks for templates. For example you can create a db resource plug-in, which allows you to store your templates in database. To use this plug-in you should refer to the templates with a db: prefix. For example $smarty->display('db:login.tpl'); or in templates {include file='db:header.tpl'}. The plug-in will find the template in the database, and return it.

Register a Smarty resource plug-in

You can register a custom Smarty resource plug-in with theregister_resource() method:

1
2
3
4
5
6
7
8

The first parameter is the name of the resource (should be at least two characters in length) and the second is an array with four function name which implement the plug-in. Every function will receive the requested resource as the first parameter and the Smarty object as the last parameter. The rest of parameters depend on the function.

From the Smarty manual:

1
2
3
4
5
6
7

• The first function, source() is supposed to retrieve the resource. Its second parameter $source is a variable passed by reference where the result should be stored. The function is supposed to return TRUE if it was able to successfully retrieve the resource and FALSE otherwise.

• The second function, timestamp() is supposed to retrieve the last modification time of the requested resource, as a UNIX timestamp. The second parameter $timestamp is a variable passed by reference where the timestamp should be stored. The function is supposed to return TRUE if the timestamp could be successfully determined, or FALSE otherwise.
• The third function, secure()is supposed to return TRUE or FALSE, depending on whether the requested resource is secure or not. This function is used only for template resources but should still be defined.
• The fourth function, trusted() is supposed to return TRUE or FALSE, depending on whether the requested resource is trusted or not. This function is used for only for PHP script components requested by {include_php} tag or {insert} tag with the src attribute. However, it should still be defined even for template resources.

You can find on the manual page a possible implementation of the db resource plugin.

Solution for our original problem: text resource

We can create a custom text resource to solve the problem mentioned in the introduction. The necessary code will be very straightforward:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

Smarty resources could be very useful in some situations, keep in mind this feature!

A little side note: I found that the built-in rich text editor is almost absolutely useless, so I turned it off, and I suggest it to every WordPress user.

Escaping the inserted code

When you want to put some source code to the post, you usually simply enclose it in code or pre tags. The problem is, that the source code may contain characters which have special meaning in the HTML language, so they should be escaped. These characters are: <, >, &, &qout; and they should be converted to: <, >, &, &qout;. I would like to have some kind of automation for this task, which could be run when we insert the text to the post.

When you insert a code (and use a syntax highlighter) you should specify the language of that code. For example if you use the WP-Syntax plugin you should enclose your code in pre tags and use the lang attribute to specify the language. In addition you can mark if you want line numbers to appear. Enclosing the copy-pasted text is another repetitive and tedious task so it is another good candidate for automation

It would be great if we could do this two task in one step, so I thought I extend the toolbar above the textarea to provide this functionality by adding a new sourcecode button to it:

The sourcecode button works similar as the others button on the toolbar, if no text is selected on the first click it inserts the open tag, on the second click it inserts the close tag. If text is selected it encloses the text in pre tags when you activate it. The button can be accessed via Ctrl-F keyboard shortcut too. Before it ads the open tag to the editor it prompts for the syntax highlighting parameters and generates the proper open tag to them. When text is selected the special characters will be replaced to HTML entities in it. This way adding source code to your post will be very straightforward:

1. Select the text in te editor:

2. Select the inserted text and press Ctrl-F:

3. Type the syntax highlighting information:

4. The resulted text is:

Extending the toolbar is quite easy, only the wp-includes/js/quicktags.js file should be slightly modified (you can download the fully modified version from here, all the modifications are commented). To add a new button to the toolbar you should add the following code:

127
128
129
130
131
132
133

After then we should modify the edInsertTag function, and we are ready:

297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413

Controlling the indentation

The WP-Syntax plugin uses GeSHi with default settings, which means that GeSHi wraps code blocks in pre tags. In this mode GeSHi doesn’t replace TAB characters with spaces, so we can’t control the appearance of the indentation. But if we instruct GeSHi to use div tags instead of pre, it will replace leading TAB characters to spaces, and you can set the number of spaces. If we want to use 4 spaces we should modify the plugin accordingly to the following:

79
80
81
82

After this modification you should probably modify your CSS. I use now the following code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

I think these modifications would be interesting in the official WordPress version too, I found them useful, now I can insert source code to the post in a very convenient way.

• You can define forms logically (including labels, validation rules, error message parameters etc.) via form configuration files. The developer module provides a web based front-end to edit these files in a convenient way.
• You have an API to create or modify forms from program code (add extra validations rule, add/modify/freeze elements etc.), this could be very useful.
• A form can render itself via renderer objects, so you can insert a form to a template adding only one line to it. Generally you should only set up a few renderer object per project, they can be reused.
• The framework validates forms automatically, it can generate client side validation code too. It redisplays the form on errors with the error messages.

It would be great if symfony came up with something similar, I found these features very handy. After this little introduction (feature request ) let me show you a solution how you can effectively handle a form for creating and modifying something.

This tutorial is not an introduction to symfony, you should have some knowledge about it. It has a really great documentation and a super tutorial, so you can learn the basics easily.

Imagine a social site, where users can get points after their activities. There are events (creating forum topic, answering a question etc.). When a user for example creates a forum topic we record a new_forum_topic event to him/her. We will now build a form for creating and editing the events in the system.

Database layout

An event has the following attributes:

• id: primary key, auto generated.
• code: we can refer to an event with it in program code, which improves the readability of the code.
• type: we differentiate public and admin actions.
• weight: how many points worth is the event.
• title: we show this text on the administration area.
• description: the description of the event.

We store the events in the following database table (you may notice that it would be nice to use an enum for the type field, but unfortunately Doctrine (a PHP ORM tool) does not support it yet):

1
2
3
4
5
6
7
8
9
10

Setting up the controller

We have two actions from the user’s point of view: creating a new event and editing an existing one), but with a little trick we can use the same symfony action and view for both of them. First let us find out the interface of the two actions. We can create an event with the URL http://example.com/award/event/add and edit it with http://example.com/award/edit/id. To achieve this we have to add the following to our routing.yml:

1
2
3
4
5
6
7
8

You can see that we mapped both functions to the same editEvent action. In the first rule we ensure that id parameter should be an integer, in the second rule we ensure that the value of the id parameter will be constantly null. Now we should add to award module’s actions.class.php the executeEditEvents method:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

Let’s walk through the code. When the page is first loaded we have one thing to do: if we are on edit phase we have to read the given event’s data from the database, and set its attributes into the request object. Maybe this seems a little strange, but I think it is a good idea, because this way the template can use transparently the request object to get the values of the input fields. Don’t worry about the line sfDoctrine::getTable('AwardEvent')->find($id); if you are not familiar with Doctrine, it loads the event from the database via the primary key, and returns an AwardEvent object filled with these data.

After posting the form we check if we are creating a new event or editing an existing one. In the first case we create a new AwardEvent object, in the second case we load it from the database. Then we set up the object’s properties from the request and save the event. Finally we assign a flash message to the user and make a redirect to the list page of the events.

Creating the view

We are almost ready with the controller part of our program, let’s make now the view. We should create a file named editEventSuccess.php in the module’s templates directory with the following content:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

There is nothing special here, we display the form, the only important thing is to set the proper action to the form tag. You can see that we use the form_error() helper (that’s why we include the Validation helper), which displays the error message related to the given field. Maybe you are wondering a little, because we haven’t done any error handling yet. You are right, so let’s do it.

Input validation

To make symfony validate the user input you should create an editEvent.yml file in the module’s validate directory with following content:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

I won’t introduce symfony’s input validation, you can read about it in the previously mentioned symfony book. The structure of the file is straightforward, the only interesting thing is the sfDoctrineUniqueValidator which ensures that the value of code field should be unique in the award_event table. If we define this file in the proper directory, symfony will automatically validate the input data. If everything is okey it calls the executeEditEvent method of our action class, but if there is any error, it tries to call the handleErrorEditEvent method. If this method is not presented in the class symfony would use the sfView::ERROR template. While we want to show the error messages in the same template (which is the sfView::SUCCESS), we have to add the following method to the awardAction class:

1
2
3

And now we have the fully functional create/edit form. I hope you have found this tutorial useful, I believe this is a good solution to reuse as much code as possible.

I tried it out and I noticed that it doesn’t look as fancy as in the demo page. After a fast search I found that I need the following CSS addition:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

I added it to theme’s CSS, and I was happy. I started to finish my first post, but I noticed a very annoying behavior of the plug-in. The sample code contained “>” character, but in the post appeared “>”. I was a little disappointed, but I thought it will be easy to find the source of the problem.

First I looked into the source of the highlighter plug-in, and observed that GeSHi converts the HTML special chars to HTML entities with its own hcs() function. GeSHi could not be asked not to do this conversion, so I had to modify the plug-in a little:

79
80

Unfortunately the server where this blog runs has PHP older than 5.1, so I had to create my own version of htmlspecialchars_decode(), so I add this code to the plug-in too:

63
64
65
66
67

This little hack solved my problem, I hope it could be useful for others too.