[Snippet] Encryption - encrypt specific pages

I needed a solution in order to be able to encrypt specific pages, so I sat down and wrote one. I would appreciate feedback so I can tweak it before adding it to the repository.

This snippet allows you to specify which pages on your site are encrypted. It supports both shared and dedicated SSL certificates and friendly URLs. There are two ways to use it:

• Turn encryption on based on a template variable
• Turn encryption on for a template (i.e. all documents using the template will be encrypted)

First make sure you can access your site via http and https. For shared SSLs the URL would be something like https://www.hostingco.com/~foo.

Installation

1. Copy the text file into a new snippet called "Encryption".

2. Edit the $secureserver parameter to match the location of your site when it is encrypted. For example https://www.hostingco.com/~foo.

3. Edit the $unsecureserver parameter to match the location of your site when it is not encrypted. For example http://www.foo.com.

Using a Template Variable

1. Create a template variable called "encryption" that is a checkbox. The "input option values" should be "On" (capital O). The default value should be "Off".

2. Add the template variable to templates.

3. At the top of each template add the call to the snippet. For example:



4. Edit the documents to be encrypted and check the encryption checkbox.

Using a template

1. At the top of the template add the call to the snippet, setting the alwaysencrypt parameter. For example:



5. Change documents to be encrypted to use this template.

Friendly URLs

1. First test your site without using friendly URLs. If you have a problem then adding friendly URLs will not fix it.

2. Change your .htaccess file to look something like:



The line below %{SERVER_PORT} 80 must match be suitable for the URL for non encrypted access. The line below %{SERVER_PORT} 443 must be suitable for the URL for encrypted access.

That should be it!

Andy

This sounds like it would go hand in hand with ShopX. I haven’t tried it out, but it sounds great!

Have you tested this with both friendly and normal URLs, and also with other variables in the URL?

You know you might want to consider making this a plug-in instead of a snippet. The plug-in could check the template or TV value for the document and forward to the correct URL using a regular PHP header() command. You would probably want to run the plug-in at the OnWebPageInit event.

I’m gonna try this out tomorrow on a new ShopX installation - thanks!

I’ve tested it with regular and friendly URLs, along with POSTing a form. When using index.php?id=n the id is retained through the redirection so I think other parameters might work. I’ve have to look into that.

I’m not sure the advantage of using a plugin instead - the snippet is pretty simple. How would a plugin know which templates are for encrypted documents?

Andy

The plug-in could just check if the document uses the SSL template (or has the SSL TV value) before rendering the page, and if it does and the URL isn’t secure it could use a header forward.

Quote from: ZAP at Nov 30, 2006, 09:22 AM

The plug-in could just check if the document uses the SSL template (or has the SSL TV value) before rendering the page, and if it does and the URL isn’t secure it could use a header forward.

But how do you tell the plugin that templates x and y are SSL templates?

Also I’m still unsure of the advantage of using a plugin for this over a snippet. I know it is likely possible to use a plugin - with MODx there is usually more than one way to do something, but why use a plugin when the snippet seems to work ok and is simple to use?

Andy

You’re right, of course. The way that you’re doing it is perfectly fine and there’s no need to change it. I just always use plug-ins for situations like this so that I don’t need to add the snippet call to the template.

Without really knowing if this is true or not, I believe that the plug-in may be called before the template is parsed and the snippet executed, so my assumption is taht it would be a slightly more efficient way to do this (ass|u|me)...

I would just check for the number of the SSL template if I were doing this in a plug-in (one less SQL call than checking for its name), but there’s more than one way to skin a cat (is there, really? I’ve never tried.)

I tried to increase the efficiency by only performing the redirect when it is needed, i.e. when you are moving from secure to unsecure or vice versa. So assuming most of a site is unencrypted, the code executed most of the time is very simple.

By putting the snippet call in the templates, you can quickly see which templates generate encrypted pages just by looking at them. I.e. all the information for the template is kept together. I would have thought that plugins were better for site-wide changes rather than template specific changes. However the beauty of MODx is it’s flexibility to do things in a way that you prefer.

Andy

@ajayre,

This is pretty cool stuff.

On a side note, I also was wondering why a snippet was used in place of a plug-in. A plugin, with the proper event (e.g. OnWebPageInit, as mentioned), acts very similar to your current implementation, only it spans ALL templates, and does not require the snippet call in the template code. Another perk, you can Disable the plugin, disabling from all templates with one click.

I wanted encryption based on a TV. ZAP wanted encryption based on a template. So I think the snippet fits both those needs. If you want to encrypt an entire site then you don’t need a snippet or plugin.

Andy