PHP: Problems with Facebook Connect authentification - security

I would like to develop an external website using Facebook Connect instead of an own login and registration process.
On the first page (index.php) I have the following code for the login button:
<fb:login-button v="2" size="large" autologoutlink="false" onlogin="window.location='/index.php'">Connect with Facebook</fb:login-button>
For authentification, I use this library for PHP.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de" lang="de">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<meta http-equiv="content-language" content="de" />
<meta http-equiv="content-script-type" content="text/javascript" />
<meta http-equiv="content-style-type" content="text/css" />
</head>
<body>
<script src="http://static.ak.connect.facebook.com/js/api_lib/v0.4/FeatureLoader.js.php/de_DE" type="text/javascript"></script><script type="text/javascript">FB.init("XYZ");</script>
<?php
error_reporting(E_ALL);
include_once '/XYZ/facebook.php';
include_once 'lib.php';
include_once 'config.php';
$facebook = new Facebook($api_key, $secret);
$user = $facebook->require_login();
$loggedin = FALSE;
if (isset($user)) {
if ($user != '') {
echo '<p>Hello <fb:name firstnameonly="true" uid="'.$user.'" useyou="false" /></p>';
echo '<p>Log out</p>';
$loggedin = TRUE;
}
}
if ($loggedin == FALSE) {
echo '<p><fb:login-button onlogin="window.location=\'/\'"></fb:login-button></p>';
}
?>
</body>
</html>
Unfortunately, it doesn't work yet. What is wrong here?
When I want to access this page, I'm redirected to http://www.facebook.com/login.php?api_key=XYZ&v=1.0&next=XYZ where I have to log in. Then, being logged in to Facebook, I'm redirected again. This time, I get to https://login.facebook.com/login.php?auth_token=XYZ

try
$user = $facebook->get_loggedin_user();
instead of
$user = $facebook->require_login();
require_login() will force you to the facebook login.php

Related

How to get rid of BadRequestKeyError?

I am using Python 3. I have created the necessary folders. i.e. static and templates folder. Still, this code is not working. I get the following error werkzeug.exceptions.BadRequestKeyError
abc.py
from flask import Flask, request, render_template, redirect
app=Flask(__name__)
#app.route('/project/', methods=['GET', 'POST'])
def tryy():
name=request.method
name1=request.form["uname"]
return render_template("project1.html",name=name1)
if __name__=="__main__":
app.run(debug=True)
project.html
<!DOCTYPE html>
<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta charset="utf-8" />
<title></title>
</head>
<body>
<form action="" method="GET">
<input type="text" name="uname" />
<input type="submit" value="Signup" />
</form>
</body>
</html>
project1.html
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title></title>
<link rel="stylesheet" type="text/css"
href="{{url_for('static', filename='style.css')}}" />
</head>
<body>
<h1>Hey there {{name}}. Nice to meet you</h1>
</body>
</html>
Your form action is set to ""
change it to this:
<form action="/project/" method="GET">

myfaces htmlHead is not rendered first

I have started to maintain a legacy JSF application. It uses myFaces 1.1.x and tomahawk 1.1.6. I need to print META tag X-UA-Compatible as the first element of HEAD element otherwise IE will ignore it.
<%#page contentType="text/html;charset=UTF-8" pageEncoding="UTF-8" %>
<%#taglib prefix="f" uri="http://java.sun.com/jsf/core"%>
<%#taglib prefix="h" uri="http://java.sun.com/jsf/html"%>
<%#taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%#taglib prefix="t" uri="http://myfaces.apache.org/tomahawk"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<f:view>
<t:documentHead>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta http-equiv="Content-type" content="text/html; charset=UTF-8">
It will generate
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<script type="text/javascript" src="/Viewer/faces/myFacesExtensionResource/org.apache.myfaces.renderkit.html.util.MyFacesResourceLoader/15311471/navmenu.jscookmenu.HtmlJSCookMenuRenderer/JSCookMenu.js"><!--
//--></script>
<script type="text/javascript" src="/Viewer/faces/myFacesExtensionResource/org.apache.myfaces.renderkit.html.util.MyFacesResourceLoader/15311471/navmenu.jscookmenu.HtmlJSCookMenuRenderer/MyFacesHack.js"><!--
//--></script>
<script type="text/javascript"><!--
var myThemeMiniBlackBase='/Viewer/faces/myFacesExtensionResource/org.apache.myfaces.renderkit.html.util.MyFacesResourceLoader/15311471/navmenu.jscookmenu.HtmlJSCookMenuRenderer/ThemeMiniBlack/';
//--></script>
<script type="text/javascript" src="/Viewer/faces/myFacesExtensionResource/org.apache.myfaces.renderkit.html.util.MyFacesResourceLoader/15311471/navmenu.jscookmenu.HtmlJSCookMenuRenderer/ThemeMiniBlack/theme.js"><!--
//--></script>
<link rel="stylesheet" href="/Viewer/faces/myFacesExtensionResource/org.apache.myfaces.renderkit.html.util.MyFacesResourceLoader/15311471/navmenu.jscookmenu.HtmlJSCookMenuRenderer/ThemeMiniBlack/theme.css" type="text/css" />
<script type="text/javascript" src="/Viewer/faces/myFacesExtensionResource/org.apache.myfaces.renderkit.html.util.MyFacesResourceLoader/15311471/popup.HtmlPopupRenderer/JSPopup.js"><!--
//--></script>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta http-equiv="Content-type" content="text/html; charset=UTF-8">
How can I force the META tag to be the first element? I tried plain HTML HEAD element but it did not work either.
I need
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta http-equiv="Content-type" content="text/html; charset=UTF-8">
Update:
Some of these javascripts and styles are rendered because of this tag:
<t:jscookMenu theme="ThemeMiniBlack" layout="hbr" immediate="true">
The remaining javascript comes from
<t:popup closePopupOnExitingElement="true" closePopupOnExitingPopup="true"
displayAtDistanceX="10" displayAtDistanceY="20" styleClass="popup">
The question is if I can enforce that what I put to t:documentHead has a precedence? I worry I will need to write my custom tag.
I would give a try to adding the meta tag yourself in a custom java filter.
<filter>
<filter-name>MetaTagsFilter</filter-name>
<filter-class>com.yournamespace.MetaTagsFilter</filter-class>
</filter>
Then do a filter mapping for the JSF servlet:
<filter-mapping>
<filter-name>MetaTagsFilter</filter-name>
<servlet-name>FacesServlet</servlet-name>
</filter-mapping>
<servlet-mapping>
<servlet-name>FacesServlet</servlet-name>
<url-pattern>*.faces</url-pattern>
</servlet-mapping>
In your filter logic, add the meta tag, after the servlet has performed the processing, kind of this:
#Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain filterChain) throws IOException, ServletException {
HtmlResponseWrapper capturingResponseWrapper = new HtmlResponseWrapper(
(HttpServletResponse) response);
filterChain.doFilter(request, capturingResponseWrapper);
if (response.getContentType() != null
&& response.getContentType().contains("text/html")) {
// Try this https://stackoverflow.com/a/32830377/1199132
capturingResponseWrapper.addHeader("X-UA-Compatible", "IE=edge");
// Or this, that way you have more control over WHERE it gets written
String content = capturingResponseWrapper.getCaptureAsString();
// replace stuff here (find the <head></head> tags and add the <meta> at the very beginning)
System.out.println(replacedContent);
response.getWriter().write(replacedContent);
}
}
See also:
Modify html response using filter
Is doFilter() executed before or after the Servlet's work is done?
What is the difference between creating JSF pages with .jsp or .xhtml or .jsf extension
The Essentials of Filters (Oracle)

Return url is loading INTO lightbox with Paypal adaptive payment, not window

I'm using a simple payment set up on an embedded flow.
Everything works well, except the return and cancel urls are being loaded into the lightbox, not the parent window, so I end up with a greyed out window with the return url page in it, and the user can't do anything.
As an example, here's the exact code from my cancel page:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
<script src="https://www.paypalobjects.com/js/external/dg.js"></script>
</head>
<body>
<div class="center">
<p>Unable to complete payment, due to either a payment cancelation, or an error.</p>
<p>No funds were transfered.</p>
</div>
<script type="text/javascript" charset="utf-8">
dgFlow = top.dgFlow || top.opener.top.dgFlow;
dgFlow.closeFlow();
top.close();
</script>
</body>
When I check out the console output, it says
top.opener is null
and it's referring to the line
dgFlow = top.dgFlow || top.opener.top.dgFlow;
Should the return URL not load into the parent window instead?
Thanks for taking a look.

Add Meta tag in View page using MVC-5

I have two meta tag in _Layout.cshtml master page and now i want to add meta tags in someone.cshtml view page.
and i also try with this code
put in _layout.cshtml master page #RenderSection("metatags",false);
put in someone.cshtml like #section metatags { <meta ... /> }
but not get success.
and also try with add meta tag jquery but not worked fine.
It should work.
Here's my master page _Layout.cshtml
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
#RenderSection("metatags", false)
<title>My ASP.NET Application</title>
</head>
<body>
#RenderBody()
</body>
</html>
Here's the index.cshtml file
#section metatags
{
<meta name="test" content="test"/>
<meta name="test2" content="test"/>
}
<div>Page content</div>
The result
<html>
<head>
<meta charset="utf-8">
<meta name="test" content="test">
<meta name="test2" content="test">
<title>My ASP.NET Application</title>
</head>
<body>
<div>Page content</div>
</body>
</html>
I found a way that works for now.
This solution mostly use when multiple master page.
In the controllers / action assign whatever meta info you need for that view.
ViewBag.Title = "some title";
ViewBag.MetaDescription = "some description";
In the View or master page get whatever meta info you need for that view.
#if(ViewBag.MetaDescription != null)
{
<meta name="description" content="#ViewBag.MetaDescription" />
}
#if(ViewBag.MetaKeywords != null)
{
<meta name="keywords" content="#ViewBag.MetaKeywords" />
}
If are using nested layouts you'll need to follow this guideline:
#RenderSection in nested razor templates
The technique you're using should work, if it is not, maybe that's the reason.
But looking at the intended use in your own answer, if you only need to modify the keywords and description tags there are apis in NopCommrece for that.
In your master layout:
<meta name="description" content="#(Html.NopMetaDescription())" />
<meta name="keywords" content="#(Html.NopMetaKeywords())" />
and in the client cshtml files
#{
Html.AddMetaDescriptionParts(Model.MetaDescription);
Html.AddMetaKeywordParts(Model.MetaKeywords);
}
There are plenty of samples for this in the NopCommerce code.
here is a good sample on how to dynamically creating meta tags in asp.net mvc:
public string HomeMetaTags()
{
var strMetaTag = new StringBuilder();
strMetaTag.AppendFormat(#"<meta content='{0}' name='Keywords'/>","Home Action Keyword");
strMetaTag.AppendFormat(#"<meta content='{0}' name='Descption'/>", "Home Description Keyword");
return strMetaTag.ToString();
}
public ActionResult Index()
{
ViewBag.Message = "Welcome to ASP.NET MVC!";
ViewBag.MetaTag = HomeMetaTags();
return View();
}
<head>
<title>#ViewBag.Title</title>
<link href="#Url.Content("~/Content/Site.css")" rel="stylesheet" type="text/css" />
<script src="#Url.Content("~/Scripts/jquery-1.5.1.min.js")" type="text/javascript"></script>
#Html.Raw(ViewBag.MetaTag)
</head>

Rendering wrong head with login layout

Can anyone tell me how it is possibile that the following layout in a Rails 4 app
# app/views/layout/login.html.erb
<!DOCTYPE html>
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title>PIPPO</title>
<meta content="yes" name="apple-mobile-web-app-capable">
<meta content="black-translucent" name="apple-mobile-web-app-status-bar-style">
<meta name="viewport" content="initial-scale = 1.0,maximum-scale = 1.0" />
<link href="/assets/login.css" media="all" rel="stylesheet" />
<script src="/assets/login.js"></script>
<%= csrf_meta_tags %>
</head>
<body>
<div class="main-content">
<%= yield %>
</div>
</body>
</html>
With the following controller
class SessionsController < ApplicationController
layout 'login'
...
def destroy
Session.find(session[:id]).close
reset_session
respond_to do |format|
flash[:success] = t('sessions.logout')
format.html { redirect_to login_url }
end
end
end
and routes
...
get 'login', to: 'sessions#new', as: 'login'
get 'logout', to: 'sessions#destroy', as: 'logout'
...
produces the following HTML once I click on <%= link_to 'logout', logout_path %>?
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title>PIPPO</title>
<meta content="yes" name="apple-mobile-web-app-capable">
<meta content="black-translucent" name="apple-mobile-web-app-status-bar-style">
<meta name="viewport" content="initial-scale = 1.0,maximum-scale = 1.0" />
<link href="/assets/application.css" media="all" rel="stylesheet" />
<script src="/assets/application.js"></script>
<meta content="authenticity_token" name="csrf-param" />
<meta content="l9+umk+wjpXY4UFiKEeuQkGgMvjbbZ2uDxyJHowTJFo=" name="csrf-token" />
</head>
Am I missing anything here? It is two days I'm trying to figure this out.
Why is it using the head from the main layout instead of the one in login?
Thanks for your help.
UPDATE - Forgot to mention my log file states:
Rendered sessions/new.html.erb within layouts/login (1.4ms)
As per the layout name given in the question, i.e.,
app/views/layout.login.html.erb
There are couple of things wrong here:
layouts should be placed in app/views/layouts folder
File name should be login.html.erb and not layout.login.html.erb
In your case, Rails could not find login.html.erb in app/views/layouts, it rendered the default layout app/views/layouts/application.html.erb.

Resources