WisTex Network - WisTex Network

Wed, 13 Apr 2022 04:14:14 -0400

Scott M. Stolz wrote the following post Wed, 13 Apr 2022 04:14:14 -0400

Custom Themes and Integration with PHP Pages

Is there any documentation or information about integrating Hubzilla with regular PHP pages on the same domain?

The goal is to use Hubzilla as the login engine for a PHP website, which has its own template and codebase. Hubzilla would do what it does best, and the other codebase would do what it does best. Ideally, the Hubzilla theme would match the themes of the rest of the website as much as possible.

I've integrated other scripts together before, and it usually involves one or both of the following:
1. Using an include file that passes on PHP variables to the other script.
2. Using an API to interact with the other script.

Basically, the biggest thing the PHP pages need to know is if someone is logged in, and if so, who? Other than that, the two scripts wouldn't really need to interact that much.

Any easy way to accomplish this?

show all 12 comments

Scott M. Stolz

Thu, 14 Apr 2022 16:36:07 -0400 last edited: Thu, 14 Apr 2022 16:36:49 -0400

Or maybe I could approach it in another direction.

Is there a way to create pages that execute PHP within Hubzilla, preferably with the code stored in a file instead of storing PHP code in the database? The file could even be an include file that Hubzilla grabs and executes.

End goal:
1. My PHP and HTML and CSS execute on a page.
2. My pages recognize who is logged in.

Anyone have experience with that or have any ideas?

Scott M. Stolz

Thu, 14 Apr 2022 19:41:48 -0400 last edited: Thu, 14 Apr 2022 20:02:32 -0400

@Hans I am knowledgeable enough to know that I am better off using the security in Hubzilla or a well-known forum software than writing my own. Hence, the desire to use the existing user system Hubzilla has.

I basically want to outsource the user management system to Hubzilla, and my PHP pages would simply check with Hubzilla to see who is logged in and display the appropriate content based on that.

I have done this before using other scripts. For example, WHMCS has a way for you to use their login system to validate users. I have also done this with forum software before, using the forum user system for the rest of the website.

One forum software I integrated with worked with one line of code:
include '/forums/includes/common.php';
And then all I had to do was call certain variables, such as $isloggedin and $userid. Add a couple if-then statements, and you can control access, since the forum software told my PHP page who was logged in.

Scott M. Stolz

Fri, 15 Apr 2022 04:23:26 -0400 last edited: Fri, 15 Apr 2022 04:43:19 -0400

Okay, so it took me a while but I finally figured it out. This is the code you need in your PHP page to ask Hubzilla who is logged in.

This code assumes the PHP file is located in the root directory of Hubzilla.

<?php
    
    require_once('boot.php');
    
    sys_boot();
        
    if(\App::$session) {
        \App::$session->start();
    }
      else {
        session_start();
        register_shutdown_function('session_write_close');
      }    
      
      echo "<p><b>Variables:</b>";
      
      $uid = ((App::$profile_uid) ? App::$profile_uid : local_channel());
      echo "<br>User ID (from App): " . $uid;
      
      echo "<br>User ID (from session): " . $_SESSION["uid"];
      
      echo "<br>Logged In? " . $_SESSION["authenticated"];
      echo "<br>Account ID: " . $_SESSION["account_id"];
      echo "<br>User URL: " . $_SESSION["my_url"];
      echo "<br>User Address: " . $_SESSION["my_address"];
      
?>

Note: If they are not logged in, then all of the variables return nothing. It only returns values if they are logged in. And the echo statements are obviously just for testing purposes.

If you see any issues or have any suggestions, let me know.

Scott M. Stolz

Fri, 15 Apr 2022 11:19:44 -0400

@mike Thanks for the suggestions:

I tried the following code (at the bottom of what I posted earlier), and I just get NULL.

if (local_channel()) {
  $who = \App::get_channel();
}
echo "<p>Who: " . $who;
var_dump ($who);

The above code produces: Who: NULL

I did get the following to work, as far as getting the local channel:

if (local_channel() != "") {
    $localchannel = local_channel();
} else {
    $localchannel = 0;
}
echo "</p><p>Local Channel (raw): " . local_channel();
echo "<br />Local Channel (variable): " . $localchannel;

I am having difficulty executing any of the functions in the App class. I think I am missing something in my code to access things like \App::get_channel() since I just get NULL when I try.</p>

Scott M. Stolz

Sat, 16 Apr 2022 05:19:24 -0400 last edited: Sat, 16 Apr 2022 05:23:19 -0400

@mike Thanks for the additional examples.

Before, I was executing my code in test.php in the root directory of Hubzilla, which is how I got the session variables to work.

I tried the following code and put it in the file: Zotlabs/Module/Test.php

<?php
namespace Zotlabs\Module;
use App;
use Zotlabs\Web\Controller;
class Test 
extends Controller {    
    function init() {        
        //  .. do what you want and exit via redirect using goaway('some url'); or killme() to terminate the process. Commonly used for json or other api requests. Emit output using echo.         
        if (local_channel()) {            
            $channel = App::get_channel();            
            echo print_r($channel,true);            
            // goaway('https://myotherserver.something/user/' . $channel['channel_address']);        
        
            echo "<p>Channel Address: " . $channel['channel_address'];
        }    
    }    
    function get() {        
        // .. or you can return a page with your content in the middle. just return your content as a string from this function.        
        if (! local_channel()) {            
            return login();        
        }     
    }}  
?>

It works, but I discovered one issue though. If I echo anything, it includes the Hubzilla template. I am trying to execute a page without any Hubzilla HTML. I only want the variables. I will use my own HTML.

Is there a way to modify the code above so that it does not call the Hubzilla template?

Scott M. Stolz

Sat, 16 Apr 2022 15:51:22 -0400 last edited: Sat, 16 Apr 2022 15:52:45 -0400

Perhaps I should add some additional information. The purpose of this exercise is that another script on the same domain name can see who is logged into Hubzilla. This code needs to be isolated from Hubzilla (in its own directory) so that it can be maintained and updated separately. This is an integration of two scripts rather than modifying Hubzilla. I hope that clears up what I am trying to do.

Basically, Script A needs to be able to retrieve information from Script B. Other than that, ideally, they should be completely separate entities from a codebase perspective. From a user perspective, they operated as one, since both scripts know who is logged in.

Scott M. Stolz

Sat, 16 Apr 2022 17:01:08 -0400 last edited: Sat, 16 Apr 2022 17:06:37 -0400

I am not trying to make it private. The opposite actually. This will be a public website with users that can log in. The purpose of knowing who is logged in is to customize the content, not hide content.

If you are logged in, it will say "Welcome Hans," show your Hubzilla avatar, and be able to link back to your unique headquarters since it knows that about you.

I could create tables in the database and store information specific to individual users in that table. Since I know the Hubzilla user ID, I just use that as the key in my table.

If Hubzilla User 42 is logged in, query the database and show data for Hubzilla User 42.

The problem is that the Hubzilla templates are incompatible with the templates my script uses. They fight. So I just want the variables, so I can basically write my own PHP and get information from my tables in the database directly.

Later I will create a new Hubzilla template that is compatible with the Bootstrap templates I use, but I need to launch quickly, and creating a new template takes time.

Scott M. Stolz

Sat, 16 Apr 2022 17:54:47 -0400

It is more than just the theme though. The other script has to be a separate codebase. And I may even purchase third-party scripts to do certain things, and they always have their own structure. They won't work as plugins or modules. And each has its own Git repository.

What you suggest will work for code I write myself, but it won't work for third-party scripts I want to integrate or code generated from software like PHPRunner. (It's probably sacrilege to use a code generator, but it's faster for creating forms, sorry.)

In every script that I have integrated, there is always an include file that tells the rest of the script who is logged in. Most scripts call it common.php, but in Hubzilla, it appears to be boot.php. (For some frameworks, you have to use their internal API instead of using the script's PHP variables.)

Typically, if you include that include file on your page, you get all the same variables the other script gets. It basically works like a black box. You don't need to worry about how it works. It just tells you who is logged in.

I think that my first code example with require_once('boot.php'); is the way to go. I just need to figure out why some functions are executing and some are not. That might be related to how I am calling boot.php or the path of the file calling it. It could also be something in .htaccess and Rewrite interfering with things.

And I might need to alter boot.php so I can execute it in subdirectories. Right now it assumes it is called from a file located in root, and throws errors if you call it from anywhere else (mostly problems with paths to other includes no longer working).

Basically, I am missing some small nuances to get the code working as intended.

Scott M. Stolz

Sat, 16 Apr 2022 20:45:06 -0400 last edited: Sat, 16 Apr 2022 22:54:34 -0400

@Hans

You want something that is not needed in Hubzilla.

"Not needed for Hubzilla" ... I never said what I was doing was needed for Hubzilla. I am simply running Hubzilla and I am running other scripts and I want them to play well with each other. I was simply asking if anyone else were able to get a third-party script or code to work with Hubzilla. It is that simple.

And I can understand your concern about security, but that is exactly why I am structuring it the way I am. If I were to try to write my own code to handle security, then I might miss something. But when you use (or in this case include) existing proven code and use it as a black box, you are outsourcing the security to a proven script. My script becomes as secure as Hubzilla because it is using Hubzilla security.

And if I had money, I would gladly hire someone. But right now I have to work with what I have. And I have done this before successfully with other scripts. And every time it was secure.

I was just hoping that someone familiar with Hubzilla code could point me in the right direction and maybe provide example code.

Scott M. Stolz

Sat, 16 Apr 2022 21:19:13 -0400 last edited: Sat, 16 Apr 2022 21:28:50 -0400

Speaking of security, I might as well ask for a code review. Does anyone have any suggestions for this piece of code or see any security concerns? I am using Hubzilla boot.php as a black box to see who is logged in.

Code for test.php located in the root directory of Hubzilla.

<?PHP
    
// Calls boot.php from Hubzilla to get the logged-in Hubzilla user.
// Assumes that App::$profile_uid from boot.php only returns 
// an integer greater than 0 if someone is logged in.

    $uid = 0; // preset to not logged in.

    require_once('boot.php');
    
    sys_boot();
        
    if(\App::$session) {
        \App::$session->start();
    }
      else {
        session_start();
        register_shutdown_function('session_write_close');
      }    

      $uid = ((App::$profile_uid) ? App::$profile_uid : local_channel());      

// echo statements for testing purposes
/*
      echo "<p><b>Variables:</b>";
      echo "<br>User ID (from App): " . $uid;
      echo "<br>User ID (from session): " . $_SESSION["uid"];
      echo "<br>Logged In? " . $_SESSION["authenticated"];
      echo "<br>Account ID: " . $_SESSION["account_id"];
      echo "<br>User URL: " . $_SESSION["my_url"];
      echo "<br>User Address: " . $_SESSION["my_address"];
*/

    if ($uid > 0) {
        // since boot.php gave us a user ID, that user ID is logged in.
        // query database or use variables from boot.php to get info about user.
        // display customized content for that Hubzilla user.
    } else {
        // assume they are not logged in.
        // display content for unathenticated vistor.
    }

?>

The above code works, although I think there is a better way to do it, I just haven't figured it out yet.

Does anyone see any issues or have any suggestions?

Scott M. Stolz

Sat, 16 Apr 2022 21:43:39 -0400

The code in the previous post was for integration with scripts that do not or cannot use Hubzilla's template.

For code that will work as a module, and can use Hubzilla's template, then this code from @mike works better:

<?php
namespace Zotlabs\Module;
use App;
use Zotlabs\Web\Controller;
class Test 
extends Controller {    
    function init() {        
        //  .. do what you want and exit via redirect using goaway('some url');
        // or killme() to terminate the process.
        // Commonly used for json or other api requests.
        // Emit output using echo.
        if (local_channel()) {
            $channel = App::get_channel();
            echo print_r($channel,true);
            // goaway('https://example.com/user/' . $channel['channel_address']);
        
            echo "<p>Channel Address: " . $channel['channel_address'];
        }
    }
    function get() {
        // .. or you can return a page with your content in the middle.
        // just return your content as a string from this function.    
        if (! local_channel()) {
            return login();   
        }
    }}
?>

Any suggestions or improvements for this code?

Scott M. Stolz

Sat, 16 Apr 2022 23:15:09 -0400

@Hans

I am personally having shivers when I read this and I think of security

Why do I want to use Hubzilla security? Because it is better than what I could write.
Why do I use PHPRunner? Because it includes security in the forms it generates.
I actually trust Hubzilla and PHPRunner with security more than some random unvetted developer.

I am actually doing what I am doing because I want it to be secure. Hubzilla and PHPRunner know security. I let them handle that part.

I've actually hired developers before, and their code often had security issues that I or another developer had to fix. But with PHPRunner, or forum software, or Hubzilla, or other established scripts, they already have security down and keep it updated.

And PHPRunner and Hubzilla are routinely updated with security patches. That isn't the case with a here today gone tomorrow random developer I hire. So there is a reason I am outsourcing security to Hubzilla and PHPRunner. It's so my scripts are secure and updated with security patches.