writing a file on server from staff interface
Hi for my patch about facets, I currently have 2 problems : 1- how to put the file in /etc/ of installation directory (in discussion) 2- how to allow the perl script (from staff interface) to write or rewrite the yaml configuration file if a librarian decides to change some settings. If I do nothing special, YAML::DumpFile fails to (re)write the file, because - I suppose - the apache user does not have rights to access the server. So, for the moment, the only way I found to make my config file editable is "chmod 666". But I suppose it is not very safe... Do you know if there is a safer way to do that? How is managed for example for SolR configuration files? Regards Mathieu -- Mathieu Saby Service d'Informatique Documentaire Service Commun de Documentation Université Rennes 2 Téléphone : 02 99 14 12 65 Courriel : mathieu.saby@univ-rennes2.fr
Hi, On Tue, Sep 24, 2013 at 12:31 PM, Mathieu Saby <mathieu.saby@univ-rennes2.fr
wrote:
1- how to put the file in /etc/ of installation directory (in discussion) 2- how to allow the perl script (from staff interface) to write or rewrite the yaml configuration file if a librarian decides to change some settings.
If I do nothing special, YAML::DumpFile fails to (re)write the file, because - I suppose - the apache user does not have rights to access the server. So, for the moment, the only way I found to make my config file editable is "chmod 666". But I suppose it is not very safe...
It is indeed not very safe -- this is actually one of the (implicit) reasons why I was suggesting that the configuration be stored in the database. If nothing else, the output of YAML::DumpFile could be stored in a syspref; while this would likely not be best possible design, it is much better IMO to do that than open a potential security hole by having Koha write to the filesystem -- /especialy/ a configuration file. Regards, Galen -- Galen Charlton Manager of Implementation Equinox Software, Inc. / The Open Source Experts email: gmc@esilibrary.com direct: +1 770-709-5581 cell: +1 404-984-4366 skype: gmcharlt web: http://www.esilibrary.com/ Supporting Koha and Evergreen: http://koha-community.org & http://evergreen-ils.org
Greetings, Chown the files: 664, and make the group www-data (or whatever group the script will end up running as). 666 is just evil. Pun intended. Though, limiting exposure of an entire configuration file by only modifying a single system preference is clearly a more secure idea. GPML, Mark Tompsett -----Original Message----- From: Mathieu Saby Sent: Tuesday, September 24, 2013 3:31 PM To: Koha Devel Subject: [Koha-devel] writing a file on server from staff interface Hi for my patch about facets, I currently have 2 problems : 1- how to put the file in /etc/ of installation directory (in discussion) 2- how to allow the perl script (from staff interface) to write or rewrite the yaml configuration file if a librarian decides to change some settings. If I do nothing special, YAML::DumpFile fails to (re)write the file, because - I suppose - the apache user does not have rights to access the server. So, for the moment, the only way I found to make my config file editable is "chmod 666". But I suppose it is not very safe... Do you know if there is a safer way to do that? How is managed for example for SolR configuration files? Regards Mathieu -- Mathieu Saby Service d'Informatique Documentaire Service Commun de Documentation Université Rennes 2 Téléphone : 02 99 14 12 65 Courriel : mathieu.saby@univ-rennes2.fr _______________________________________________ Koha-devel mailing list Koha-devel@lists.koha-community.org http://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
Thanks for your answers! I started with the idea of a YAML file because it was easy to manage and already used by SolR configuration, but it was maybe not a good choice. The technical choice for facet configuration must be safe, and avoid the need for libraries to change the configuration of groups or users on their servers. And I am not fond of the idea of 1 or 2 sysprefs (unimarc/marc21) with a big block of YAML data inside. Not user friendly, and risky (oups, I forgot a space...) So from what I read, I see 2 solutions : - forgetting YAML and putting the configuration in a small new sql table. - putting YAML in a syspref, but not modifying it directly, but through a user friendly form on a specific page. I have never seen that in Koha, so I don't know if it will complies to the coding rules... Mathieu Le 24/09/2013 22:24, Mark Tompsett a écrit :
Greetings,
Chown the files: 664, and make the group www-data (or whatever group the script will end up running as). 666 is just evil. Pun intended. Though, limiting exposure of an entire configuration file by only modifying a single system preference is clearly a more secure idea.
GPML, Mark Tompsett
-----Original Message----- From: Mathieu Saby Sent: Tuesday, September 24, 2013 3:31 PM To: Koha Devel Subject: [Koha-devel] writing a file on server from staff interface
Hi for my patch about facets, I currently have 2 problems : 1- how to put the file in /etc/ of installation directory (in discussion) 2- how to allow the perl script (from staff interface) to write or rewrite the yaml configuration file if a librarian decides to change some settings.
If I do nothing special, YAML::DumpFile fails to (re)write the file, because - I suppose - the apache user does not have rights to access the server. So, for the moment, the only way I found to make my config file editable is "chmod 666". But I suppose it is not very safe...
Do you know if there is a safer way to do that? How is managed for example for SolR configuration files?
Regards Mathieu
-- Mathieu Saby Service d'Informatique Documentaire Service Commun de Documentation Université Rennes 2 Téléphone : 02 99 14 12 65 Courriel : mathieu.saby@univ-rennes2.fr
Mathieu, I think a YAML file is reasonable, but not in user-editable contexts. - putting YAML in a syspref, but not modifying it directly, but through a
user friendly form on a specific page. I have never seen that in Koha, so I don't know if it will complies to the coding rules..
This is how "Did you mean?" is configured. There wasn't enough configuration required to justify a new table, so I just stuck JSON into the syspref. Regards, Jared -- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
Thanks Jared I'm looking at didyoumean.pl, and that's what I needed! I will try to write something similar in YAML or JSON (any preferences between the two? I know more YAML...) Mathieu Le 24/09/2013 23:02, Jared Camins-Esakov a écrit :
Mathieu,
I think a YAML file is reasonable, but not in user-editable contexts.
- putting YAML in a syspref, but not modifying it directly, but through a user friendly form on a specific page. I have never seen that in Koha, so I don't know if it will complies to the coding rules..
This is how "Did you mean?" is configured. There wasn't enough configuration required to justify a new table, so I just stuck JSON into the syspref.
Regards, Jared
-- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com <mailto:jcamins@cpbibliography.com> (web) http://www.cpbibliography.com/
-- Mathieu Saby Service d'Informatique Documentaire Service Commun de Documentation Université Rennes 2 Téléphone : 02 99 14 12 65 Courriel : mathieu.saby@univ-rennes2.fr
Mathieu, Thanks Jared
I'm looking at didyoumean.pl, and that's what I needed! I will try to write something similar in YAML or JSON (any preferences between the two? I know more YAML...)
I prefer JSON because I don't ever edit by hand, and JSON is much faster. Regards, Jared -- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
Jared Camins-Esakov schreef op di 24-09-2013 om 17:59 [-0400]:
I prefer JSON because I don't ever edit by hand, and JSON is much faster.
In this case, wouldn't a Perl structure make more sense? -- Robin Sheat Catalyst IT Ltd. ✆ +64 4 803 2204 GPG: 5FA7 4B49 1E4D CAA4 4C38 8505 77F5 B724 F871 3BDF
Robin,
I prefer JSON because I don't ever edit by hand, and JSON is much
faster.
In this case, wouldn't a Perl structure make more sense?
Nope. Storable is much slower than JSON. And architecture changes can cause data loss. Regards, Jared -- Jared Camins-Esakov Bibliographer, C & P Bibliography Services, LLC (phone) +1 (917) 727-3445 (e-mail) jcamins@cpbibliography.com (web) http://www.cpbibliography.com/
participants (5)
-
Galen Charlton -
Jared Camins-Esakov -
Mark Tompsett -
Mathieu Saby -
Robin Sheat