From 4df853abccd48d89e1dfce6dfc1a0b9c5a34c7ee Mon Sep 17 00:00:00 2001
From: Cesar G To use any methods contained with the Once an instance of the class has been created you are free to call the various methods it contains. Please note that should you wish to use the The Where userdata is the array containing the aforementioned data. This method is the primary way of determining what a user can and cannot do for a given option globally or in a given forum. The method should be called in the following way: Where option is a string representing the required option, e.g. 'f_list', 'm_edit', 'a_adduser', etc. By adding a ! in front of the option, e.g. '!f_list' the result of this method will be negated. The optional forum term is the integer forum_id. The method should be called thus: As with the This method is used to find out in which forums a user is allowed to carry out an operation or to find out in which forums he is not allowed to carry out an operation. The method should be called in the following way: Just like in the The method returns an associative array of the form: Where option is the option passed to the method and integer is either zero or a positive integer and the same auth
class it first needs to be instantiated. This is best achieved early in the execution of the script in the following manner:
-$auth = new phpbb\auth\auth();
-
auth_admin
methods you will need to instantiate this separately but in the same way.acl
method is the initialisation routine for all the acl functions. If you intend calling any acl method you must first call this. The method takes as its one and only required parameter an associative array containing user information as stored in the database. This array must contain at least the following information; user_id, user_permissions and user_type. It is called in the following way:
-$auth->acl(
userdata
);
- userdata
);
+
userdata
);
-$result = $auth->acl_get(
option
[, forum
]);
- option
[, forum
]);
+
option
[, forum
]);
-$result = $auth->acl_gets(
option1
[, option2
, ..., optionN
, forum
]);
- option1
[, option2
, ..., optionN
, forum
]);
+
acl_get
method the options are strings representing the required permissions to check. The forum again is an integer representing a given forum_id.option1
[, option2
, ..., <
-$result = $auth->acl_getf(
option
[, clean
]);
- option
[, clean
]);
+
acl_get
method the option is a string specifying the permission which has to be checked (negation using ! is allowed). The second parameter is a boolean. If it is set to false this method returns all forums with either zero or a positive integer. If it is set to true only those forums with a positive integer as the result will be returned.
-array(forum_id1 => array(option => integer), forum_id2 => ...)
-
acl_get(option, forum_id)
would return.acl_getf(option, true)
returned one or more forums but it's faster. It should be called in the following way:
-$result = $auth->acl_getf_global(option
)
-
option
)
+
As with the previous methods option is a string specifying the permission which has to be checked.
@@ -247,8 +247,8 @@ $result = $auth->acl_get_list($user_id, $permissions, $forum_id);To use any methods this class contains it first needs to be instantiated separately from auth
. This is achieved in the same way as auth
:
-$auth_admin = new auth_admin(); -
This instance gives you access to both the methods of this specific class and that of auth
.
{TAB}$mode{TAB}{TAB}= $request->variable('mode', ''); -{TAB}$search_id{TAB}= $request->variable('search_id', ''); -
If entered with tabs (replace the {TAB}) both equal signs need to be on the same column.
@@ -135,8 +135,8 @@ * For full copyright and license information, please see * the docs/CREDITS.txt file. * -*/ - +*/ +Please see the File Locations section for the correct package name.
@@ -159,8 +159,8 @@ /** */ -{CODE} - +{CODE} +Functions should also be named descriptively. We're not programming in C here, we don't want to write functions called things like "stristr()". Again, all lower-case names with words separated by a single underscore character in PHP, and camel caps in JavaScript. Function names should be prefixed with "phpbb_" and preferably have a verb in them somewhere. Good function names are phpbb_print_login_status()
, phpbb_get_user_data()
, etc. Constructor functions in JavaScript should begin with a capital letter.
\phpbb\class_name - phpbb/class_name.php \phpbb\dir\class_name - phpbb/dir/class_name.php -\phpbb\dir\subdir\class_name - phpbb/dir/subdir/class_name.php -
// These are all right.
@@ -397,8 +397,8 @@ while (condition) for ($i = 0; $i < size; $i++) { do_stuff(); -} -
In PHP code, braces always go on their own line. The closing brace should also always be at the same column as the corresponding opening brace, examples:
@@ -429,8 +429,8 @@ while (condition) function do_stuff() { ... -} - +} +In JavaScript code, braces always go on the same line:
@@ -453,8 +453,8 @@ while (condition) { function do_stuff() { ... -} - +} +This is another simple, easy step that helps keep code readable without much effort. Whenever you write an assignment, expression, etc.. Always leave one space between the tokens. Basically, write code as if it was English. Put spaces between variable names and operators. Don't put spaces just after an opening bracket or before a closing bracket. Don't put spaces just before a comma or a semicolon. This is best shown with a few examples, examples:
@@ -478,26 +478,26 @@ for($i=0; $i<$size; $i++) ... for ($i = 0; $i < $size; $i++) ... $i=($j < $size)?0:1; -$i = ($j < $size) ? 0 : 1; - +$i = ($j < $size) ? 0 : 1; +Do you know the exact precedence of all the operators in PHP? Neither do I. Don't guess. Always make it obvious by using brackets to force the precedence of an equation so you know what it does. Remember to not over-use this, as it may harden the readability. Basically, do not enclose single expressions. Examples:
// what's the result? who knows.
--$bool = ($i < 7 && $j > 8 || $k == 4); -
$bool = ($i < 7 && $j > 8 || $k == 4);+
// now you can be certain what I'm doing here.
--$bool = (($i < 7) && (($j < 8) || ($k == 4))); -
$bool = (($i < 7) && (($j < 8) || ($k == 4)));+
// But this one is even better, because it is easier on the eye but the intention is preserved
--$bool = ($i < 7 && ($j < 8 || $k == 4)); -
$bool = ($i < 7 && ($j < 8 || $k == 4));+
There are two different ways to quote strings in PHP - either with single quotes or with double quotes. The main difference is that the parser does variable interpolation in double-quoted strings, but not in single quoted strings. Because of this, you should always use single quotes unless you specifically need variable interpolation to be done on that string. This way, we can save the parser the trouble of parsing a bunch of strings where no interpolation needs to be done.
@@ -507,25 +507,25 @@ $bool = ($i < 7 && ($j < 8 || $k == 4));$str = "This is a really long string with no variables for the parser to find."; -do_stuff("$str"); -
// right
$str = 'This is a really long string with no variables for the parser to find.'; -do_stuff($str); -
// Sometimes single quotes are just not right
-$post_url = $phpbb_root_path . 'posting.' . $phpEx . '?mode=' . $mode . '&start=' . $start; -
// Double quotes are sometimes needed to not overcrowd the line with concatenations.
-$post_url = "{$phpbb_root_path}posting.$phpEx?mode=$mode&start=$start"; -
In SQL statements mixing single and double quotes is partly allowed (following the guidelines listed here about SQL formatting), else one should try to only use one method - mostly single quotes.
@@ -537,40 +537,40 @@ $post_url = "{$phpbb_root_path}posting.$phpEx?mode=$mode&start=$start"; $foo = array( 'bar' => 42, 'boo' => 23 -); - +); +// right
$foo = array( 'bar' => 42, 'boo' => 23, -); -
In PHP, it's legal to use a literal string as a key to an associative array without quoting that string. We don't want to do this -- the string should always be quoted to avoid confusion. Note that this is only when we're using a literal, not when we're using a variable, examples:
// wrong
--$foo = $assoc_array[blah]; -
$foo = $assoc_array[blah];+
// right
--$foo = $assoc_array['blah']; -
$foo = $assoc_array['blah'];+
// wrong
--$foo = $assoc_array["$var"]; -
$foo = $assoc_array["$var"];+
// right
--$foo = $assoc_array[$var]; -
$foo = $assoc_array[$var];+
Each complex function should be preceded by a comment that tells a programmer everything they need to know to use that function. The meaning of every parameter, the expected input, and the output are required as a minimal comment. The function's behaviour in error conditions (and what those error conditions are) should also be present - but mostly included within the comment about the output.
Especially important to document are any assumptions the code makes, or preconditions for its proper operation. Any one of the developers should be able to look at any part of the application and figure out what's going on in a reasonable amount of time.
Avoid using /* */
comment blocks for one-line comments, //
should be used for one/two-liners.
// wrong
$array[++$i] = $j; -$array[$i++] = $k; -
// right
@@ -593,39 +593,38 @@ $i++; $array[$i] = $j; $array[$i] = $k; -$i++; -
Inline conditionals should only be used to do very simple things. Preferably, they will only be used to do assignments, and not for function calls or anything complex at all. They can be harmful to readability if used incorrectly, so don't fall in love with saving typing by using them, examples:
// Bad place to use them
-($i < $size && $j > $size) ? do_stuff($foo) : do_stuff($bar); -
// OK place to use them
-$min = ($i < $j) ? $i : $j; -
For phpBB3, we intend to use a higher level of run-time error reporting. This will mean that the use of an uninitialized variable will be reported as a warning. These warnings can be avoided by using the built-in isset() function to check whether a variable has been set - but preferably the variable is always existing. For checking if an array has a key set this can come in handy though, examples:
// Wrong
--if ($forum) ... -
if ($forum) ...+
// Right
--if (isset($forum)) ... -
if (isset($forum)) ...
// Also possible
--if (isset($forum) && $forum == 5) -
if (isset($forum) && $forum == 5)+
The empty()
function is useful if you want to check if a variable is not set or being empty (an empty string, 0 as an integer or string, NULL, false, an empty array or a variable declared, but without a value in a class). Therefore empty should be used in favor of isset($array) && sizeof($array) > 0
- this can be written in a shorter way as !empty($array)
.
// Good
@@ -660,8 +659,8 @@ switch ($mode) default: // Always assume that a case was not caught break; -} -
// Also good, if you have more code between the case and the break
@@ -684,8 +683,8 @@ switch ($mode) // Always assume that a case was not caught break; -} -
Even if the break for the default case is not needed, it is sometimes better to include it just for readability and completeness.
@@ -712,8 +711,8 @@ switch ($mode) // Always assume that a case was not caught break; -} - +} +Use the explicit visibility qualifiers public
, private
and protected
for all properties instead of var
.
@@ -723,14 +722,14 @@ switch ($mode)
//Wrong
var $x; -private static function f() -
// Right
public $x; -static private function f() -
Prefer class constants over global constants created with define()
.
Here the example with the tabs applied:
@@ -761,8 +760,8 @@ $sql = 'SELECT * WHERE a = 1 AND (b = 2 OR b = 3) - ORDER BY b'; - + ORDER BY b'; +Use double quotes where applicable. (The variables in these examples are typecasted to integers beforehand.) Examples:
@@ -771,16 +770,16 @@ $sql = 'SELECT *"UPDATE " . SOME_TABLE . " SET something = something_else WHERE a = $b"; -'UPDATE ' . SOME_TABLE . ' SET something = ' . $user_id . ' WHERE a = ' . $something; -
// These are right.
'UPDATE ' . SOME_TABLE . " SET something = something_else WHERE a = $b"; -'UPDATE ' . SOME_TABLE . " SET something = $user_id WHERE a = $something"; -
In other words use single quotes where no variable substitution is required or where the variable involved shouldn't appear within double quotes. Otherwise use double quotes.
@@ -791,15 +790,15 @@ $sql = 'SELECT *$sql = 'SELECT * FROM ' . SOME_TABLE . ' - WHERE a != 2'; -
// This is right.
$sql = 'SELECT * FROM ' . SOME_TABLE . ' - WHERE a <> 2'; -
$sql = 'SELECT * FROM ' . SOME_TABLE . " - WHERE username = '" . $db->sql_escape($username) . "'"; -
To complete the example, this is how an update statement would look like:
@@ -847,8 +846,8 @@ $sql_ary = array( $sql = 'UPDATE ' . SOME_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . ' WHERE user_id = ' . (int) $user_id; -$db->sql_query($sql); - +$db->sql_query($sql); +The $db->sql_build_array()
function supports the following modes: INSERT
(example above), INSERT_SELECT
(building query for INSERT INTO table (...) SELECT value, column ...
statements), UPDATE
(example above) and SELECT
(for building WHERE statement [AND logic]).
Based on the number of values in $forum_ids, the query can look differently.
// SQL Statement if $forum_ids = array(1, 2, 3);
-SELECT FROM phpbb_forums WHERE forum_id IN (1, 2, 3) -
// SQL Statement if $forum_ids = array(1) or $forum_ids = 1
-SELECT FROM phpbb_forums WHERE forum_id = 1 -
Of course the same is possible for doing a negative match against a number of values:
@@ -905,22 +904,22 @@ SELECT FROM phpbb_forums WHERE forum_id = 1 $sql = 'SELECT * FROM ' . FORUMS_TABLE . ' WHERE ' . $db->sql_in_set('forum_id', $forum_ids, true); -$db->sql_query($sql); - +$db->sql_query($sql); +Based on the number of values in $forum_ids, the query can look differently here too.
// SQL Statement if $forum_ids = array(1, 2, 3);
-SELECT FROM phpbb_forums WHERE forum_id NOT IN (1, 2, 3) -
// SQL Statement if $forum_ids = array(1) or $forum_ids = 1
-SELECT FROM phpbb_forums WHERE forum_id <> 1 -
If the given array is empty, an error will be produced.
@@ -950,8 +949,8 @@ $sql_array = array( 'ORDER_BY' => 'left_id', ); -$sql = $db->sql_build_query('SELECT', $sql_array); - +$sql = $db->sql_build_query('SELECT', $sql_array); +The possible first parameter for sql_build_query() is SELECT or SELECT_DISTINCT. As you can see, the logic is pretty self-explaining. For the LEFT_JOIN key, just add another array if you want to join on to tables for example. The added benefit of using this construct is that you are able to easily build the query statement based on conditions - for example the above LEFT_JOIN is only necessary if server side topic tracking is enabled; a slight adjustement would be:
@@ -986,8 +985,8 @@ else // Here we read the cookie data } -$sql = $db->sql_build_query('SELECT', $sql_array); - +$sql = $db->sql_build_query('SELECT', $sql_array); +// You are able to assign the (not changing) result within the loop itself
for ($i = 0, $size = sizeof($post_data); $i < $size; $i++) { do_something(); -} -
Try to avoid using in_array() on huge arrays, and try to not place them into loops if the array to check consist of more than 20 entries. in_array() can be very time consuming and uses a lot of cpu processing time. For little checks it is not noticeable, but if checked against a huge array within a loop those checks alone can take several seconds. If you need this functionality, try using isset() on the arrays keys instead, actually shifting the values into keys and vice versa. A call to isset($array[$var])
is a lot faster than in_array($var, array_keys($array))
for example.
// Old method, do not use it
$start = (isset($HTTP_GET_VARS['start'])) ? intval($HTTP_GET_VARS['start']) : intval($HTTP_POST_VARS['start']); -$submit = (isset($HTTP_POST_VARS['submit'])) ? true : false; -
// Use request var and define a default variable (use the correct type)
$start = $request->variable('start', 0); -$submit = $request->is_set_post('submit'); -
// $start is an int, the following use of $request->variable() therefore is not allowed
-$start = $request->variable('start', '0'); -
// Getting an array, keys are integers, value defaults to 0
-$mark_array = $request->variable('mark', array(0)); -
// Getting an array, keys are strings, value defaults to 0
-$action_ary = $request->variable('action', array('' => 0)); -
To show a forum login box use login_forum_box($forum_data)
, else use the login_box()
function.
The string passed to add_form_key()
needs to match the string passed to check_form_key()
. Another requirement for this to work correctly is that all forms include the {S_FORM_TOKEN}
template variable.
$user->session_begin(); $auth->acl($user->data); -$user->setup(); -
The $user->setup()
call can be used to pass on additional language definition and a custom style (used in viewforum).
All messages/errors should be outputted by calling trigger_error()
using the appropriate message type and language string. Example:
-trigger_error('NO_FORUM'); -
-trigger_error($user->lang['NO_FORUM']); -
-trigger_error('NO_MODE', E_USER_ERROR); -
The append_sid()
function from 2.0.x is available too, though it does not handle url alterations automatically. Please have a look at the code documentation if you want to get more details on how to use append_sid(). A sample call to append_sid() can look like this:
-append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=group&g=' . $row['group_id']) -
Templates should be produced in a consistent manner. Where appropriate they should be based off an existing copy, e.g. index, viewforum or viewtopic (the combination of which implement a range of conditional and variable forms). Please also note that the indentation and coding guidelines also apply to templates where possible.
@@ -2358,8 +2357,8 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) 'PAGE_OF' => 'Page %s of %s', /* Just grabbing the replacements as they come and hope they are in the right order */ - ... - + ... +… a clearer way to show explicit replacement ordering is to do:
@@ -2368,8 +2367,8 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) 'PAGE_OF' => 'Page %1$s of %2$s', /* Explicit ordering of the replacements, even if they are the same order as English */ - ... - + ... +Why bother at all? Because some languages, the string transliterated back to English might read something like:
@@ -2378,8 +2377,8 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) 'PAGE_OF' => 'Total of %2$s pages, currently on page %1$s', /* Explicit ordering of the replacements, reversed compared to English as the total comes first */ - ... - + ... +... $user->lang('NUMBER_OF_ELEPHANTS', $number_of_elephants); - ... -
And the English translation would be:
@@ -2409,8 +2408,8 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) 1 => 'You have 1 elephant', // Singular 2 => 'You have %d elephants', // Plural ), - ... - + ... +While the Bosnian translation can have more cases:
@@ -2422,16 +2421,16 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) 2 => 'You have %d slona', // Used for 5, 6, 3 => ... ), - ... - + ... +NOTE: It is okay to use plurals for an unknown number compared to a single item, when the number is not known and displayed:
... 'MODERATOR' => 'Moderator', // Your board has 1 moderator 'MODERATORS' => 'Moderators', // Your board has multiple moderators - ... -
// Good - Literal straight quotes should be escaped with a backslash, ie: \
@@ -2454,8 +2453,8 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) ... 'CONV_ERROR_NO_AVATAR_PATH' => 'Note to developer: you must specify $convertor[\'avatar_path\'] to use %s.', - ... - + ... +However, because phpBB3 now uses UTF-8 as its sole encoding, we can actually use this to our advantage and not have to remember to escape a straight quote when we don't have to:
@@ -2464,24 +2463,24 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2))... 'USE_PERMISSIONS' => 'Test out user's permissions', - ... -
// Okay - However, non-programmers wouldn't type "user\'s" automatically
... 'USE_PERMISSIONS' => 'Test out user\'s permissions', - ... -
// Best - Use the Unicode Right-Single-Quotation-Mark character
... 'USE_PERMISSIONS' => 'Test out user’s permissions', - ... -
The "
(straight double quote), <
(less-than sign) and >
(greater-than sign) characters can all be used as displayed glyphs or as part of HTML markup, for example:
// Okay - No more invalid HTML, but """ is rather clumsy
@@ -2500,8 +2499,8 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) ... 'FOO_BAR' => 'PHP version < 5.3.3.<br /> Visit "Downloads" at <a href="http://www.php.net/">www.php.net</a>.', - ... - + ... +// Best - No more invalid HTML, and usage of correct typographical quotation marks
@@ -2509,8 +2508,8 @@ if (utf8_case_fold_nfc($string1) == utf8_case_fold_nfc($string2)) ... 'FOO_BAR' => 'PHP version < 5.3.3.<br /> Visit “Downloads” at <a href="http://www.php.net/">www.php.net</a>.', - ... - + ... +Lastly, the &
(ampersand) must always be entitised regardless of where it is used:
... 'FOO_BAR' => '<a href="http://somedomain.tld/?foo=1&bar=2">Foo & Bar</a>.', - ... -
// Good - Valid HTML, amperands are correctly entitised in all cases
... 'FOO_BAR' => '<a href="http://somedomain.tld/?foo=1&bar=2">Foo & Bar</a>.', - ... -
As for how these charcters are entered depends very much on choice of Operating System, current language locale/keyboard configuration and native abilities of the text editor used to edit phpBB language files. Please see http://en.wikipedia.org/wiki/Unicode#Input_methods for more information.