Bob, Thanks for the help. By the way, I love the lightheartedness behind the expression "something like this" - it brought a smile to my face.
Let me begin by emphasizing the Historical Need for your book. I surely cannot be alone. I worked my way diligently through Larry Ullman’s "PHP6 and MySQL5" and felt at the end of it that I really had learnt something. Now that I look at the stuff of which MODx is made I feel as if I know nothing. To try to sort out some problems I was having with the bit of code you posted I went to have a look at the API. That is only for the initiated, though. Hieroglyphics to the rest of us. We need a book that explains the relevant OOP principles in a practical context.
Anyway, I tried your first bit of code to close the gaping security hole and only give logged-in people access to the csv file. To do that I created a resource group containing only the relevant resource, then created a user group called mailmanager containing me as the sole user and the csv resource as the sole resource. Tried to make sure the relevant access and context permissions were correct.
Then set up a front end login page that would redirect to the page with the csv-generating snippet call in its content area.
This was the tricky bit of the snippet (you suggested ’user’ but I wondered after looking at the API if that should be ’modUser’):
if ($modx->modUser->isMember('mailmanager')) {
/* Code to generate csv file */
} else {
return ('Sorry, you are not authorised to access this resource');
}
That gave me the following fatal error: Fatal error: Call to a member function isMember() on a non-object.
Tried 5 or 6 variations on that theme using various things found in the API (like isAuthenticated or getUserGroups using that first to get the user groups for that particular user before checking membership). All generated fatal errors because of some non-object.
Where can a guy turn at times like these? Bob Ray’s FAQs, that’s where. And I find the following:
How can I tell if a user is logged in?
In a snippet, the API function $modx->userLoggedIn() returns true if the user is logged in.
So I used that at the top of my snippet and it works (and I am assuming that the security hole is now sufficiently plugged).
<?php
if ($modx->userLoggedIn()){
require_once('../mysqli_connect.php');
$query = "SELECT modx_users.username, modx_user_attributes.email FROM modx_users INNER JOIN modx_user_attributes ON modx_users.id = modx_user_attributes.internalKey";
$values = mysqli_query($dbc, $query);
if($values) {
$csv_output = '';
while ($row = mysqli_fetch_row($values)) {
$csv_output .= $row[0].", ".$row[1]."\n";
}}
$file = "mailinglist";
$filename = $file."_".date("Y-m-d_H-i",time());
header("Content-type: application/vnd.ms-excel");
header("Content-disposition: csv" . date("Y-m-d") . ".csv");
header( "Content-disposition: filename=".$filename.".csv");
print $csv_output;
mysqli_close($dbc);
exit;
} else {
return ('Sorry, you are not authorised to access this resource');
}
?>
Couldn’t get the second bit of code you offered to work, but, not to worry, I am happy with what I have got so far.
Thanks.
