From 5778715c8a02888c49be042506ca16c10c7f8f10 Mon Sep 17 00:00:00 2001 From: gggeek Date: Mon, 9 Jan 2023 12:10:07 +0000 Subject: [PATCH] demo improvements --- demo/client/agesort.php | 6 ++-- demo/client/getstatename.php | 4 +-- demo/client/introspect.php | 2 +- demo/client/proxy.php | 2 +- demo/client/which.php | 2 +- demo/client/wrap.php | 4 +-- demo/server/discuss.php | 14 ++++++++- demo/server/methodProviders/functions.php | 4 +-- demo/server/methodProviders/interop.php | 2 +- demo/server/methodProviders/testsuite.php | 4 +-- demo/server/methodProviders/validator1.php | 2 +- demo/server/methodProviders/wrapper.php | 8 ++--- demo/server/proxy.php | 36 +++++++++++++++------- demo/server/server.php | 19 ++++++------ demo/vardemo.php | 4 +-- 15 files changed, 70 insertions(+), 43 deletions(-) diff --git a/demo/client/agesort.php b/demo/client/agesort.php index 7ab2b959..6a599b13 100644 --- a/demo/client/agesort.php +++ b/demo/client/agesort.php @@ -2,11 +2,11 @@ require_once __DIR__ . "/_prepend.php"; output(' -xmlrpc - Agesort demo +phpxmlrpc - Agesort demo

Agesort demo

Send an array of "name" => "age" pairs to the server that will send it back sorted.

The code demonstrates usage of automatic encoding/decoding of php variables into xmlrpc values such as arrays and structs

The code demonstrates usage of automatic encoding/decoding of php variables into xml-rpc values such as arrays and structs

Have a look at vardemo.php for more examples of manual encoding and decoding

You can see the source to this page here: agesort.php

'); @@ -31,7 +31,7 @@ output(''); // Create xml-rpc parameters from the input array: an array of structs $encoder = new Encoder(); $v = $encoder->encode($inAr); -output("Encoded into xmlrpc format it looks like this:

\n" . htmlentities($v->serialize()) . "

\n"); +output("Encoded into xml-rpc format it looks like this:

\n" . htmlentities($v->serialize()) . "

\n"); // create client and request objects $req = new Request('examples.sortByAge', array($v)); diff --git a/demo/client/getstatename.php b/demo/client/getstatename.php index ee838b56..dfcef9ff 100644 --- a/demo/client/getstatename.php +++ b/demo/client/getstatename.php @@ -2,11 +2,11 @@ require_once __DIR__ . "/_prepend.php"; output(' -xmlrpc - Getstatename demo +phpxmlrpc - Getstatename demo

Getstatename demo

Send a U.S. state number to the server and get back the state name

The source code demonstrates basic lib usage, including manual creation and decoding of of xml-rpc values

The source code demonstrates basic lib usage, including manual creation and decoding of xml-rpc values

You can see the source to this page here: getstatename.php

'); diff --git a/demo/client/introspect.php b/demo/client/introspect.php index 683ad907..b0919806 100644 --- a/demo/client/introspect.php +++ b/demo/client/introspect.php @@ -2,7 +2,7 @@ require_once __DIR__ . "/_prepend.php"; output(' -xmlrpc - Introspect demo +phpxmlrpc - Introspect demo

Introspect demo

Query server for available methods, their description and their signatures

diff --git a/demo/client/proxy.php b/demo/client/proxy.php index f776c023..35b70584 100644 --- a/demo/client/proxy.php +++ b/demo/client/proxy.php @@ -2,7 +2,7 @@ require_once __DIR__ . "/_prepend.php"; output(' -xmlrpc - Proxy demo +phpxmlrpc - Proxy demo

proxy demo

Query server using a "proxy" object

diff --git a/demo/client/which.php b/demo/client/which.php index 07fb3dc6..21f06e7b 100644 --- a/demo/client/which.php +++ b/demo/client/which.php @@ -2,7 +2,7 @@ require_once __DIR__ . "/_prepend.php"; output(' -xmlrpc - Which toolkit demo +phpxmlrpc - Which toolkit demo

Which toolkit demo

Query server for toolkit information

diff --git a/demo/client/wrap.php b/demo/client/wrap.php index a97e1685..aaf7b70a 100644 --- a/demo/client/wrap.php +++ b/demo/client/wrap.php @@ -2,14 +2,14 @@ require_once __DIR__ . "/_prepend.php"; output(' -xmlrpc - Webservice wrapper demo +phpxmlrpc - Webservice wrapper demo

Webservice wrapper demo

Wrap methods exposed by server into php functions

The code demonstrates usage of some of the most automagic client usage possible:
- 1) client that returns php values instead of xmlrpc value objects
+ 1) client that returns php values instead of xml-rpc Value objects
2) wrapping of remote methods into php functions
See also proxy.php for an alternative take

diff --git a/demo/server/discuss.php b/demo/server/discuss.php index 6ee592c8..2a490043 100644 --- a/demo/server/discuss.php +++ b/demo/server/discuss.php @@ -1,7 +1,12 @@ bindValue(':name', $name); $statement->bindValue(':comment', $comment); $statement->execute(); + /// @todo this insert-then-count is not really atomic - we should use a transaction $statement = $db->prepare("SELECT count(*) AS tot FROM comments WHERE msg_id = :id"); @@ -51,6 +60,9 @@ class CommentManager } /** + * NB: we know for a fact that this will be called with 1 strin arguments because of the signature used to register + * this method in the dispatch map. But nothing prevents the client from sending empty strings, nor sql-injection attempts! + * * @param string $msgID * @return Response|array[] * @throws \Exception diff --git a/demo/server/methodProviders/functions.php b/demo/server/methodProviders/functions.php index d2ccc84d..dededd81 100644 --- a/demo/server/methodProviders/functions.php +++ b/demo/server/methodProviders/functions.php @@ -1,11 +1,11 @@ decode($req->getParam(0)); - // NB: here we should validate the received url, using f.e. a whitelist... + $url = $req->getParam(0)->scalarval(); + // *** NB *** here we should validate the received url, using f.e. a whitelist of approved servers _and protocols_... + // fe. any url using the 'file://' protocol might be considered a hacking attempt $client = new Client($url); if ($req->getNumParams() > 3) { @@ -68,14 +75,17 @@ function forward_request($req) } // build call for remote server - /// @todo find a way to forward client info (such as IP) to server, either + /// @todo find a way to forward client info (such as IP) to the upstream server, either /// - as xml comments in the payload, or - /// - using std http header conventions, such as X-forwarded-for... + /// - using std http header conventions, such as X-forwarded-for (but public servers should strip + /// X-forwarded-for anyway, unless they consider this server as trusted...) $reqMethod = $req->getParam(1)->scalarval(); - $pars = $req->getParam(2); $req = new Request($reqMethod); - foreach ($pars as $par) { - $req->addParam($par); + if ($req->getNumParams() > 1) { + $pars = $req->getParam(2); + foreach ($pars as $par) { + $req->addParam($par); + } } // add debug info into response we give back to caller @@ -84,6 +94,9 @@ function forward_request($req) return $client->send($req, $timeout); } +// Given that the target server is left to be picked by the caller, it might support the '' xml-rpc extension +PhpXmlRpc\PhpXmlRpc::$xmlrpc_null_extension = true; + // Run the server // NB: take care not to output anything else after this call, as it will mess up the responses and it will be hard to // debug. In case you have to do so, at least re-emit a correct Content-Length http header (requires output buffering) @@ -92,10 +105,11 @@ $server = new Server( 'xmlrpcproxy.call' => array( 'function' => 'forward_request', 'signature' => array( + array('mixed', 'string', 'string'), array('mixed', 'string', 'string', 'array'), array('mixed', 'string', 'string', 'array', 'struct'), ), - 'docstring' => 'forwards xmlrpc calls to remote servers. Returns remote method\'s response. Accepts params: remote server url (might include basic auth credentials), method name, array of params, and (optionally) a struct containing call options', + 'docstring' => 'forwards xml-rpc calls to remote servers. Returns remote method\'s response. Accepts params: remote server url (might include basic auth credentials), method name, array of params (optional), and a struct containing call options (optional)', ), ) ); diff --git a/demo/server/server.php b/demo/server/server.php index d8737750..93691b66 100644 --- a/demo/server/server.php +++ b/demo/server/server.php @@ -1,10 +1,11 @@ setDebug(3); -$s->compress_response = true; // Out-of-band information: let the client manipulate the server operations. // We do this to help the testsuite script: do not reproduce in production! diff --git a/demo/vardemo.php b/demo/vardemo.php index 66ed3ea7..22c54295 100644 --- a/demo/vardemo.php +++ b/demo/vardemo.php @@ -2,7 +2,7 @@ require_once __DIR__ . "/client/_prepend.php"; output(' -xmlrpc +phpxmlrpc '); @@ -76,7 +76,7 @@ $myObject->public = new \PhpXmlRpc\Value('a public property, wrapped'); $w = new PhpXmlRpc\Value($myObject, 'struct'); output("Struct encoding a php object:

" . htmlentities($w->serialize()) . "

"); -output("

Testing value serialization - xmlrpc extensions

\n"); +output("

Testing value serialization - xml-rpc extensions

\n"); $v = new PhpXmlRpc\Value(1234, 'i8'); output("I8:

" . htmlentities($v->serialize()) . "

"); $v = new PhpXmlRpc\Value(null, 'null'); -- 2.47.0