Securing CMS

Only a short one today.  At work we had an issue that we needed to secure our CMS to only be available for internal access. I had a few ideas, but after some research I found something very cool that was apart of IIS (6 and 7).  There is an option to secure a site or directory (or application) to only certain IP's. Its called "IPv4 Address and Domain Restrictions".

The reason why I'm blogging about this is because this is an easy way of adding an extra layer of security to a normal CMS.  Most CMS's are available for running locally, and this means that they are something that can be easily access, and the code can be analysed.  From a security point of view, this is a concern.  To mitigate against this, securing the main administration directories (login etc) using the IP restrictions in IIS adds an extra layer to the security of the application.

The easiest way to use this is to deny all access, and then only allow the IP's that you want to access the directory (usually internal and one or two external IP's).

Hope this helps.

Changes to Facebook API

Today we had something interesting happen at work.  We had just implemented some Facebook functionality on a project that was ready for release, and just before it was signed off today, a final end to end test was completed.  Part of that test was to test some functionality with social networks.  When the Facebook functionality was tested, it failed.

The functionality was meant to pre-populate the message box with a message that the user updated.  On Wednesday this was working, and today it wasn't.  Lets just say that this caused a few questions to be asked and a few worried people moving the corridors.  How can functionality that was working one day break the next when we made no changes to the code?  After some searching the web (Google is mostly always your friend), I found my answer.  Let me break it down for you.

Firstly, we were using the Javascript Library, specifically the FB.ui functionality. Using the Feed dialog box, we would place our user augmented message into the message box, which the user could then update and publish on their wall.  Now looking at the reference from the Facebook developers page (seen here http://developers.facebook.com/docs/reference/dialogs/feed/ ) the message property is what we used to pre-fill the dialog box. As you can see there is a note on the property that states that the field will be ignored on the 12th July, 2011.  So why was it still working two days ago (3/8 to be specific)?

Before I go into that let me first look at the policy for Apps in Facebook. If you go to the policy page (seen here http://developers.facebook.com/policy/ ) and read section 4 sub section 2 it states that an app will not pre-fill any fields.  (Then in the following sub section it states that the user can give permission for an app to post on their behalf. That is a task for next week.)

So back to the question, why did it just stop working?  If I were to guess, and that is all that I would be doing, I would say that Facebook just got fed up with people not looking at the policies and following them.  Apps should only pre fill the form when the user has done it some where else in the work flow.  I would say that there were plenty of apps that just didn't follow the rules and they just decided to enforce the rules.  And to be honest, I have no problem with them enforcing their policy.

Now, what is the lesson learned from all this?  Is it that we should not trust Facebook?  I would say not.  For me? The lesson is that when you are using third party services you need to be aware that what you don't control what happens with them.  You should intermittently test the services, just to make sure that they work as expected.  That is if you want to make sure that your sites and applications maintain the functionality that you build them with.
Hope this helps!

Something Different

It has been some time since my last blog post, and this one is not going to be along the same vein as normal. I will try to post something relating to my completing the underived version of the JOCU project, but work has slowed to almost a crawl as I am in the midst of work around the house (my computer is currently in pieces in the hallway, and I am using it mainly though my phone, not ideal for coding).

So, if I'm not going to relating something code related, I hear you ask what do I have to say?  Well, I have been playing with my phone (I have a Samsung Galaxy S i9000) and came across Darkys ROM.  Now, never having looked at custom ROM before, I was cautious as to whether this was a good idea or not.

Well, I must say I am impressed.  I have always know that my phone had more grunt than it used, like it was being restrained.  After setting up Darkys ROM, I can see a definite performance improvement.  There is instant response to touch input, as a result of using the 9.5 ROM, I am on Android 2.2.1, which has it’s own improvements.  Overall, I am very happy with my phone.  I mean, I was happy before, but now more so.  I even still have access to the built in Samsung Apps.

Something to note though, doing this has it’s risks. The Galaxy S is one of the few Android phones on the market that you can brick.  I also performed the update on my little brothers phone, and while the end result was the same, the process was not the greatest, a few times I thought I had bricked his phone.  But, in the end I got it working.  Doing this is at your own risk.

Now for the links:

Darkys Rom Home: http://www.darkyrom.com
2.2 – 2.2.1 install process: http://www.darkyrom.com/community/index.php?threads/guide-installing-darkys-rom-on-2-2-2-2-1-i9000-i9000m-only.1041/

I did an install from 2.1 to Darkys 9.5, but that one wasn't so smooth (my little brothers phone), so I wont post that here, I recommend that you use Google yourself.

JOCU – The Final Stretch

So, I have the basics of an XML parser completed, now I need to implement this to deliver what I am wanting, which is the Java OData Consuming Utility.  I am going to work on the loosely typed or underived version first, then I will implement the derived version.

Briefly, lets look at the functionality we can expect from the repository. 

string GetSource() / SetSource(string)
This will define what the source of the oData is.

bool GetMetadataRequired() / void SetMetadataRequired(bool)
This will set or get if the metadata is required for this repository

ODataEntities Fetch()
This will get the entities from the oData query

IODataQuery Filter(string)
Applies the filter URI convention to the source

IODataQuery SetEntityCollection(string)
This will define which collection that it is desired to get

IODataQuery GetEntity(string)
Gets a single entity from the collection

IODataQuery SetOrderBy(string)
Sets what the list is ordered by

IODataQuery Top(string)
Sets the number of entities that we want returned

IODataQuery Expand(string)
Sets which related entities to expand

IODataQuery Format(string)
Sets the format to return the data in (not used really for what I want, should I scrap it?)

IODataQuery Select(string)
Identifies which entity items to select, and related items

IODataQuery InlineCount(string)
Sets the inline count property on the data source

IODataQuery CustomURIElement(string)
Sets a custom element to the query that is sent to the OData source

string GetMetadata(string)
This will get the OData collection metadata entry

And, from the point of view of the entity we have the following:

string Get(string)
Gets the value of the key passed though

string GetMetadata(string)
Gets the metadata value for the key passed though

Most of this is derived from the OData URI conventions, with some basic access functions thrown in.  I think that this is all I need to implement, but to be honest I’m not sure.  I have a feeling I will be uncovering more than I expect as I start to tackle the implementation of the repository access, but I need to start somewhere, and this is the best place.  I am aiming to finish this off in the next month or so, but as I am doing this in my spare time to have some fun we shall see what happens.