From interchange-cvs at icdevgroup.org  Mon Dec 10 19:15:44 2012
From: interchange-cvs at icdevgroup.org (Mark Johnson)
Date: Mon, 10 Dec 2012 19:15:44 +0000
Subject: [interchange] captcha refresh
Message-ID: <E1Ti8pM-0001lA-J6@elmo.icdevgroup.org>

commit 5a1ba34afdfb5623c83aacd1e4ed116421a4bd54
Author: Mark Johnson <mark at endpoint.com>
Date:   Mon Dec 10 14:12:31 2012 -0500

    captcha refresh
    
    Optional global config to pull in that creates the
    [captcha-refresh] tag to ask for a new captcha image
    if it can't be read.

 code/SystemTag/captcha.coretag |    3 +
 eg/captcha_refresh.cfg         |  171 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 174 insertions(+), 0 deletions(-)
---
diff --git a/code/SystemTag/captcha.coretag b/code/SystemTag/captcha.coretag
index 8d7f459..47807fb 100644
--- a/code/SystemTag/captcha.coretag
+++ b/code/SystemTag/captcha.coretag
@@ -96,6 +96,9 @@ sub {
 		}
 	}
 	else {
+		# Used for [captcha-refresh] if requested
+		$::Instance->{last_captcha_build_opt} = { %$opt };
+
 	    my $save_u = umask($::Variable->{CAPTCHA_UMASK} || 2);
 
 		if($opt->{reset}) {
diff --git a/eg/captcha_refresh.cfg b/eg/captcha_refresh.cfg
new file mode 100644
index 0000000..f3cb318
--- /dev/null
+++ b/eg/captcha_refresh.cfg
@@ -0,0 +1,171 @@
+# captcha refresh: Provide a refresh feature to use in conjunction with the
+# stock [captcha] tag by Mark Johnson <mark(at)endpoint(dot)com>
+#
+# To use:
+#
+# 1. Put this in, or include from, interchange.cfg and restart.
+#
+# 2. Place call to [captcha-refresh] where you would like to see the
+# refresh link appear. See documentation within usertag defintion below.
+#
+# 3. The captcha-refresh process couples tag and actionmap definitions.
+# Ensure there is no conflict with the actionmap name and any existing
+# custom maps for your implementation.
+
+UserTag  captcha-refresh  addAttr
+UserTag  captcha-refresh  Routine <<EOR
+use 5.10.0;
+sub {
+    my $opt = shift;
+    my %cache = %{
+        delete ($opt->{use_last}) && $::Instance->{last_captcha_build_opt} || {}
+    };
+
+    my $anc = delete ($opt->{anchor}) || 'refresh image';
+    my $img_id = delete $opt->{img_id};
+    my $js_func_name = delete ($opt->{js_func_name}) || 'captcha_refresh';
+
+    my @uri = (delete ($opt->{am}) || 'captcha-refresh');
+
+    my %unq_keys;
+    @unq_keys{ keys %cache, keys %$opt } = ();
+    push (@uri,
+        join (
+            '=',
+            ($_, $::Tag->filter(urlencode => ($opt->{$_} // $cache{$_} // '')))
+        )
+    )
+        for keys %unq_keys;
+
+    my $url = $::Tag->area({ href => join ('/', @uri) });
+
+    my $script = qq{
+        <a href="#captcha" onclick="$js_func_name()">$anc</a>
+        <script>
+        function $js_func_name() {
+            var ajax = new XMLHttpRequest();
+
+            ajax.onreadystatechange = function() {
+                if (ajax.readyState == 4 && ajax.status == 200) {
+                    document.getElementById('$img_id').src = ajax.responseText;
+                }
+            }
+
+            ajax.open('GET','$url',true);
+            ajax.send();
+            return;
+        }
+        </script>
+    };
+
+    return $script;
+}
+EOR
+
+CodeDef  captcha-refresh  ActionMap
+CodeDef  captcha-refresh  Routine  <<EOR
+sub {
+    my (undef, %opt) = split (m{[/=]+}, shift);
+    $_ = $::Tag->filter(urldecode => $_)
+        for values %opt;
+
+    # Always name_only since we're updating the img's src param
+    $opt{name_only} = 1;
+
+    my $doc = Vend::Document->new;
+    $doc->hot(1);
+    $doc->write($::Tag->captcha(\%opt));
+    return 0;
+}
+EOR
+
+UserTag  captcha-refresh  Documentation <<EOD
+=head1 NAME
+
+Captcha refresh
+
+=head1 DESCRIPTION
+
+Given a call to [captcha] to generate a check image, place a subsequent call
+to [captcha-refresh] where you would like to insert a hyperlink to refresh the
+image. The call will bundle the necessary parameters to duplicate the
+appropriate call to [captcha] into an AJAX GET back to the complementary
+captcha-refresh actionmap. The actionmap will build the new image and return
+the new URL to the image, to which the original <img> tag's src field will be
+set.
+
+As long as the [captcha-refresh] call is processed after the most recent call
+to [captcha] itself, the calling parameters for the latter call can be easily
+tied to the refresh request and not need to be duplicated. The calling order
+can always be enforced via the use of [output] or, if simpler, using scratch
+to store the [captcha] results and display later in the page.
+
+=over 4
+
+=item B<img_id> (required)
+
+The refresh code needs to be able to reference the original image so that the
+newly formed captcha image can overwrite the previous, discarded one. Thus,
+your captcha image must include an "id" attribute in the <img> tag, and that
+value must be included in this param.
+
+=item B<use_last>
+
+When true, the code will pull in the attribute list of the last non-check call
+to [captcha]. In order to refresh the image under the same terms as the
+original, the code needs access to the calling params used. These can either
+be duplicated in the call to [captcha-refresh] or referenced via B<use_last>
+
+=item B<anchor>
+
+Value to use for the link itself. Defaults to 'refresh image'. To use an
+image, supply the entire <img> tag.
+
+=item B<am>
+
+Alternate actionmap name to use to refresh the captcha image. Default is
+'captcha-refresh' and is included in the .cfg build file for this tag.
+
+=item B<js_func_name>
+
+Name of javascript function built from this tag to handle the refresh request
+and image update. Default is 'captcha_refresh'. Should only need to change if
+there is a conflict with an existing JS function.
+
+=back
+
+You can also provide any of the options defined for [captcha] itself, which
+will be necessary without use of the B<use_last> option. If B<use_last> and
+explicit [captcha] options are combined, options set in [captcha-refresh] will
+override those derived from the B<use_last> call.
+
+=head1 EXAMPLE
+
+ <form action="[area @@MV_PAGE@@]" method="post">
+ ...
+ <input name="mv_captcha_guess" size="6" autocomplete="off" />
+ <img
+    id="captcha_image"
+    style="vertical-align: middle"
+    src="[captcha
+            function=image
+            length=6
+            image_location=captcha
+            image_path=/images/captcha
+            name_only=1
+    ]"
+ />
+ &nbsp;
+ [captcha-refresh
+        img_id=captcha_image
+        use_last=1
+    ]
+ ...
+ <input type="submit" value="Submit" />
+
+=head1 AUTHOR
+
+Mark Johnson <mark(at)endpoint(dot)com>
+
+=cut
+EOD


From interchange-cvs at icdevgroup.org  Tue Dec 11 01:51:10 2012
From: interchange-cvs at icdevgroup.org (Mark Johnson)
Date: Tue, 11 Dec 2012 01:51:10 +0000
Subject: [interchange] IC cache busting for captcha refresh.
Message-ID: <E1TiF02-00045T-UL@elmo.icdevgroup.org>

commit 4d5a1b20270d38f2d1883ef8461428c30ad43a77
Author: Mark Johnson <mark at endpoint.com>
Date:   Mon Dec 10 20:50:36 2012 -0500

    IC cache busting for captcha refresh.

 eg/captcha_refresh.cfg |    8 +++++++-
 1 files changed, 7 insertions(+), 1 deletions(-)
---
diff --git a/eg/captcha_refresh.cfg b/eg/captcha_refresh.cfg
index f3cb318..06051fb 100644
--- a/eg/captcha_refresh.cfg
+++ b/eg/captcha_refresh.cfg
@@ -44,6 +44,8 @@ sub {
         <script>
         function $js_func_name() {
             var ajax = new XMLHttpRequest();
+            // Extra cache-busting insurance if header doesn't work
+            var cb = new Date().getTime();
 
             ajax.onreadystatechange = function() {
                 if (ajax.readyState == 4 && ajax.status == 200) {
@@ -51,7 +53,7 @@ sub {
                 }
             }
 
-            ajax.open('GET','$url',true);
+            ajax.open('GET','$url?cb='+cb,true);
             ajax.send();
             return;
         }
@@ -73,6 +75,10 @@ sub {
     $opt{name_only} = 1;
 
     my $doc = Vend::Document->new;
+
+    # Bust that cache for IE
+    $doc->header('Cache-Control: no-cache');
+
     $doc->hot(1);
     $doc->write($::Tag->captcha(\%opt));
     return 0;


From interchange-cvs at icdevgroup.org  Sat Dec 15 12:48:26 2012
From: interchange-cvs at icdevgroup.org (Stefan Hornburg)
Date: Sat, 15 Dec 2012 12:48:26 +0000
Subject: [interchange] Suppress error message in [assign] when using the
	documented behaviour of passing an empty string.
Message-ID: <E1TjrAI-00036S-Ig@elmo.icdevgroup.org>

commit 5479b9aa307d8eb6f3d158949beca730c582879a
Author: Stefan Hornburg (Racke) <racke at linuxia.de>
Date:   Sat Dec 15 13:45:34 2012 +0100

    Suppress error message in [assign] when using the documented behaviour of passing an empty string.

 code/SystemTag/assign.coretag |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)
---
diff --git a/code/SystemTag/assign.coretag b/code/SystemTag/assign.coretag
index c582902..8e2cdfb 100644
--- a/code/SystemTag/assign.coretag
+++ b/code/SystemTag/assign.coretag
@@ -34,11 +34,13 @@ sub {
 			$Vend::Session->{assigned}{$_} = $value;
 		}
 		else {
-			logError(
-				"Attempted assign of non-numeric '%s' to %s. Deleted.",
-				$value,
-				$_,
-			);
+            if ($value) {
+    			logError(
+	    			"Attempted assign of non-numeric '%s' to %s. Deleted.",
+		    		$value,
+			    	$_,
+			    );
+            }
 			delete $Vend::Session->{assigned}{$_};
 		}
 	}


From interchange-cvs at icdevgroup.org  Mon Dec 24 23:25:17 2012
From: interchange-cvs at icdevgroup.org (Josh Lavin)
Date: Mon, 24 Dec 2012 23:25:17 +0000
Subject: [interchange] Fix logging messages for Jobs so ErrorDestination can
	redirect them
Message-ID: <E1TnHOX-0006k5-Pj@elmo.icdevgroup.org>

commit f87a69551d4254327eb641c6f1226cf8a03a3c5e
Author: Josh Lavin <josh at perusion.com>
Date:   Mon Dec 24 15:24:45 2012 -0800

    Fix logging messages for Jobs so ErrorDestination can redirect them
    
    Allows directives like this to work:
    
    ErrorDestination  "Run jobs group=%s pid=%s"  logs/jobs_run.log
    ErrorDestination  "Finished jobs group=%s pid=%s"  logs/jobs_run.log

 lib/Vend/Dispatch.pm |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)
---
diff --git a/lib/Vend/Dispatch.pm b/lib/Vend/Dispatch.pm
index c39f7fb..d944803 100644
--- a/lib/Vend/Dispatch.pm
+++ b/lib/Vend/Dispatch.pm
@@ -723,7 +723,7 @@ sub run_in_catalog {
 
 	open_cat($cat);
 
-	logError("Run jobs group=%s pid=$$", $job || 'INTERNAL');
+	logError("Run jobs group=%s pid=%s", $job || 'INTERNAL', $$);
 
 	Vend::Server::set_process_name("job $cat $job");
 	
@@ -824,7 +824,7 @@ sub run_in_catalog {
 			$errors = 1;
 
 			$failure = errmsg('Job terminated with an error: %s', $@);
-			logError ("Job group=%s pid=$$ terminated with an error: %s", $job || 'INTERNAL', $@);
+			logError ("Job group=%s pid=%s terminated with an error: %s", $job || 'INTERNAL', $$, $@);
 			
 			# remove flag for this job
 			Vend::Server::flag_job($$, $cat, 'furl');
@@ -846,7 +846,7 @@ sub run_in_catalog {
 	}
 	$out .= full_dump() if is_yes($jobscfg->{add_session});
 
-	logError("Finished jobs group=%s pid=$$", $job || 'INTERNAL');
+	logError("Finished jobs group=%s pid=%s", $job || 'INTERNAL', $$);
 	
 	close_cat();
 


From interchange-cvs at icdevgroup.org  Mon Dec 24 23:55:45 2012
From: interchange-cvs at icdevgroup.org (Josh Lavin)
Date: Mon, 24 Dec 2012 23:55:45 +0000
Subject: [interchange] Set MV_PASSWORD cookie to be secure if set from a
	secure page
Message-ID: <E1TnHs1-0007Y8-Ah@elmo.icdevgroup.org>

commit 13e4f4e183be96f625667605644e22e8e9cfc474
Author: Josh Lavin <josh at perusion.com>
Date:   Mon Dec 24 15:53:47 2012 -0800

    Set MV_PASSWORD cookie to be secure if set from a secure page
    
    Adds new option for UserDB, "secure_cookies". Defaults to 1 if called from HTTPS page.

 lib/Vend/UserDB.pm |    9 +++++----
 1 files changed, 5 insertions(+), 4 deletions(-)
---
diff --git a/lib/Vend/UserDB.pm b/lib/Vend/UserDB.pm
index e2ae946..94ef5d0 100644
--- a/lib/Vend/UserDB.pm
+++ b/lib/Vend/UserDB.pm
@@ -1568,7 +1568,7 @@ sub login {
 						);
 		}
 
-		username_cookies($self->{PASSED_USERNAME} || $self->{USERNAME}, $pw) 
+		username_cookies($self->{PASSED_USERNAME} || $self->{USERNAME}, $pw, $self->{OPTIONS}{secure_cookies}) 
 			if $Vend::Cfg->{CookieLogin};
 
 		if ($self->{LOCATION}{LAST} ne 'none') {
@@ -1985,7 +1985,7 @@ sub new_account {
 		else {
 			$self->set_values() unless $self->{OPTIONS}{no_set};
 			$self->{USERNAME} = $foreign if $foreign;
-			username_cookies($self->{USERNAME}, $pw) 
+			username_cookies($self->{USERNAME}, $pw, $self->{OPTIONS}{secure_cookies}) 
 				if $Vend::Cfg->{CookieLogin};
 
 			$self->log('new account') if $options{'log'};
@@ -2013,7 +2013,7 @@ sub new_account {
 }
 
 sub username_cookies {
-		my ($user, $pw) = @_;
+		my ($user, $pw, $secure) = @_;
 		return unless
 			 $CGI::values{mv_cookie_password}		or
 			 $CGI::values{mv_cookie_username}		or
@@ -2021,13 +2021,14 @@ sub username_cookies {
 			 Vend::Util::read_cookie('MV_USERNAME');
 		$::Instance->{Cookies} = [] unless defined $::Instance->{Cookies};
 		my $exp = time() + $Vend::Cfg->{SaveExpire};
+		$secure ||= $CGI::secure;
 		push @{$::Instance->{Cookies}},
 			['MV_USERNAME', $user, $exp];
 		return unless
 			$CGI::values{mv_cookie_password}		or
 			Vend::Util::read_cookie('MV_PASSWORD');
 		push @{$::Instance->{Cookies}},
-			['MV_PASSWORD', $pw, $exp];
+			['MV_PASSWORD', $pw, $exp, undef, undef, $secure];
 		return;
 }