You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: app/pages/6.0/02.background/04.dont-reinvent-the-wheel/docs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ wip: true
6
6
7
7
I think that for a lot of developers - novices and professionals alike - building on top of others' work can seem like a betrayal of our trade. We're not "real" developers unless we built everything with our bare hands from scratch, and know firsthand the nitty-gritty details of how our code works. With third-party components, we have to take time to actually *learn* how to use them, and follow *their* rules. I get it. It all feels so antithetical to the DIY spirit that got so many of us into coding in the first place. Trust me, as someone who built a cold frame out of some doors and framing I found in the dumpster, I know:
However unlike me with with my cold frame, software developers aren't limited by the contents of their local dumpster. With the advent of Composer, the PHP community abounds with free, high-quality third-party packages for pretty much every task imaginable. The trick is to know *which* packages to use, and to avoid getting overwhelmed.
Copy file name to clipboardExpand all lines: app/pages/6.0/02.background/05.security/01.server-misconfiguration/docs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ Many PHP developers are used to seeing server-side error messages and stack trac
10
10
11
11
This is fine in development, and it makes the development cycle tighter by providing immediate feedback to the developer with a simple page refresh or click of a button. However in production (live server), this can lead to serious security breaches:
12
12
13
-
13
+
14
14
15
15
The lesson here is that code can contain sensitive information that we do not want to share with the end user - for example, passwords and API keys. If something goes wrong with the database connection code, it will generate a stack trace that contains the database credentials. By dumping this trace into the response, your application is risking making this information public.
Copy file name to clipboardExpand all lines: app/pages/6.0/02.background/06.seo/docs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ Google can tell when you're copying content from another page. When it sees copi
29
29
30
30
Having lots of words on a page gives Google more to work with when it determines how relevant that page is. While you may not _need_ a lot of words to get your point across, it signals to search engines that your pages' contents have real value. At the same time, you need to avoid [keyword stuffing](https://en.wikipedia.org/wiki/Keyword_stuffing) - putting an unnatural number of keywords in your content in an attempt to game the ranking algorithm. This used to work in the past, but nowadays search engines will detect and penalize you if every other sentence is "Garden shed painting."
31
31
32
-
32
+
33
33
34
34
To summarize, you need to write the text of your pages so that they have a healthy balance of your target keywords without appearing overly spammy. You _do_ know what your target keywords are, right?
Copy file name to clipboardExpand all lines: app/pages/6.0/04.installation/02.environment/01.native/02.install/docs.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -50,7 +50,7 @@ php bakery serve
50
50
51
51
You can now access UserFrosting at [http://localhost:8080](http://localhost:8080). You should see the default UserFrosting pages and login with the newly created master account.
52
52
53
-
53
+
54
54
55
55
> [!TIP]
56
56
> To stop the server, hit `ctrl+c`.
@@ -59,7 +59,7 @@ You can now access UserFrosting at [http://localhost:8080](http://localhost:8080
59
59
60
60
It will help us a lot if you could star [the UserFrosting project on GitHub](https://github.com/userfrosting/UserFrosting). Just look for the button in the upper right-hand corner!
61
61
62
-
[](https://github.com/userfrosting/UserFrosting)
62
+
[](https://github.com/userfrosting/UserFrosting)
63
63
64
64
You should also follow us on Twitter for real-time news and updates:
The tool panel will open (usually docked at the bottom) and you'll notice some tabs at the top of this panel: **Inspector**, **Console**, **Debugger**, **Style Editor**, **Performance**, **Network**, and **Settings**. By default, the Console tab should be selected (if not, click it).
Underneath that, you'll probably see a long list of URLs. These are the requests that your web browser has made so far. To the left of each URL is the request method (GET, POST, PUT, DELETE, etc). To the right is the server response summary. For example, the server responded **HTTP/1.1 200 OK** for the request to **http://localhost/userfrosting/public/alerts**. The status code **200** is used to mean that the request completed "successfully". "Success" is something that your server defines - it's just a way for the server to tell your browser that everything went as expected and that it doesn't need to do anything else.
29
29
30
30
If you click the response summary, Firefox will open the **Network** tab and show you more details about the request:
To the right, you'll see tabs for **Headers**, **Cookies**, **Params**, **Response**, and **Timings**. If you scroll down in the Headers tab, you'll see a list of the request and response headers. The request headers contain metadata sent with a particular request, and contain information about your browser, the contents of any cookies for the site, and other information. The response headers contain metadata returned by the server for that request. This can include information like cookies that the site wants the client to store or update, as well as things like the type of content (HTML, image, CSS, JSON, etc) being returned.
35
35
36
36
The **Cookies** tab just displays the contents of any cookie headers in a more easily read format.
**Params** shows any data sent in the *body* of the request. **This is extremely useful for debugging client-side code.** Often times, a web application appears to "not work" because the server isn't actually being sent the data it expected. The **Params** tab is a good way to check the actual data that was sent with a particular request.
The **Response** tab shows the data sent in the *body* of the response. For requests to a URL representing a web page (like the URL in your browser's navigation bar), the response body simply contains the actual HTML returned from the server, that your browser initially renders. For other requests, it could contain images, Javascript, or structured data in some other format. For example in the request shown above, the response contains structured JSON data representing a list of users currently registered with the application.
49
49
@@ -100,7 +100,7 @@ For example, we can use it to inspect the contents of a JSON object returned by
100
100
101
101
Now, when we do something that triggers this request, the `console.log` statement will print the contents of the variable `data` to the browser console:
As you can see in the last line of the console output, `data` is an array containing Javascript objects. If we click on "Object", a panel opens to the right that displays the contents of that object.
106
106
@@ -114,7 +114,7 @@ UserFrosting uses a sophisticated error-handling system to capture exceptions th
114
114
115
115
By default _in development mode only_, UserFrosting will show a detailed debugging page that contains a full stack trace. For example:
This page will also show you the contents of your request, the current session variables, and your server/environment variables. For [obvious reasons](background/security/server-misconfiguration), this debugging page is disabled in production.
120
120
@@ -272,7 +272,7 @@ The best approach is to develop your API in isolation from the page or widget th
272
272
273
273
As it turns out, you can visit `/api/members` _directly in your browser_, and it will show you the output of the data source! Since **visiting a page in your browser is equivalent to making a GET request**, you can append query strings as well:
274
274
275
-
275
+
276
276
277
277
Make sure you get the data API itself working properly and producing the kind of output you expect, before you fiddle with the page and/or Javascript that is consuming the API.
Copy file name to clipboardExpand all lines: app/pages/6.0/05.troubleshooting/02.getting-help/docs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -48,7 +48,7 @@ Check [Stack Overflow](http://stackoverflow.com/tags/userfrosting) and the [issu
48
48
49
49
Markdown is the _de facto_ standard for basic text formatting on the web. If you are unfamiliar with Markdown, please [take a few minutes to learn](https://guides.github.com/features/mastering-markdown/#what). It will help you all over the web! In particular, please make sure you know where the **backtick** key (`) is located on your keyboard:
Copy file name to clipboardExpand all lines: app/pages/6.0/06.sprinkles/04.customize/docs.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -269,7 +269,7 @@ In `default.php`, add the following:
269
269
270
270
This customizes some basic properties for our application - you can set your site title, author, author's URL, and timezone. Reload the page, and you should see the new site title appear in the upper left corner:
271
271
272
-
272
+
273
273
274
274
The template for this page dynamically pulls that particular piece of text from your new configuration file. Note that your value for `site.title` overrides the value of `site.title` in the core sprinkle's configuration file.
Copy file name to clipboardExpand all lines: app/pages/6.0/10.users/01.user-accounts/docs.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -62,7 +62,7 @@ UserFrosting comes with two built-in mechanisms for creating new accounts: publi
62
62
63
63
In many instances, you will want people to be able to register for your website or application through a publicly accessible page. By default, the registration form is available at `/account/register`.
When the registration form is submitted, it will `POST` to the `/account/register` endpoint (which invokes the `RegisterAction` method).
68
68
@@ -89,17 +89,17 @@ To disable this behavior, set the `site.registration.require_email_verification`
89
89
90
90
Sometimes, you want to have a site administrator create an account on behalf of a specific user. For some applications, you may want this to be the _only_ way that new accounts can be created. To create a new user as an administrator, use the "create user" button at the bottom of the main user listing page:
You can then fill out details for the user. After you create the user, an email will be automatically sent to them that allows them to set their own password.
95
95
96
-
96
+
97
97
98
98
## Login form
99
99
100
100
By default, the login form is available at `/account/sign-in`. The user provides their email or username as their identity, along with their password. The form is submitted to `/account/login`, which invokes `LoginAction`. This processes the authentication request.
101
101
102
-
102
+
103
103
104
104
The `/account/login` route is throttled via the `throttles.sign_in_attempt` throttle rule. This mitigates against the possibility of brute-force attempts to guess your users' passwords.
105
105
@@ -123,7 +123,7 @@ After the page containing the sign-in form receives a response from the server t
123
123
124
124
Users can reset their passwords by visiting `/account/forgot-password`. They will be asked for their account email address:
125
125
126
-
126
+
127
127
128
128
Upon submitting a password reset request, a secret token will be issued for the user's account (stored in `password_resets` table), and emailed to them in the form of a link (`/account/set-password/confirm`). The link will take them to a form with the secret token embedded in the page, where they can set their new password. The form is then submitted to `/account/set-password`, which updates the user's password and signs them in.
129
129
@@ -143,7 +143,7 @@ For the precise implementation of the password reset and account verification re
143
143
144
144
Users can update certain attributes of their accounts through the account settings/profile page. By default, this is available at `/account/settings`:
As a security measure, users are required to verify their current password before they can update their email address or password. Other fields, like name and locale, do not require the authenticated user to re-enter their password.
149
149
@@ -194,15 +194,15 @@ Basic user details (name, email, locale, group) can be modified via the "Edit us
194
194
195
195
Roles can be added to or removed from a user account via the `Manage roles` button on the user's profile page, or in the dropdown menu in the user table.
196
196
197
-
197
+
198
198
199
199
By default, only the root account can change users' roles. You may want to modify this to allow site admins to grant a **subset** of the available roles to other users - but be careful! You may not want site administrators to be allowed to elevate other users to site administrator, for example. See the section on [access control](users/access-control) for more information.
200
200
201
201
### Reset a user's password
202
202
203
203
Administrators may be able to perform a password reset on behalf of users. This is useful, for example, when you have users who have difficulty with the self-service password reset tool. Password resets can be performed via the "Password" button in the user's profile page, or the "change password" option in the dropdown menu of the user table.
You may send a password reset link to the user so that they can change it themselves, or even set a password directly when dealing with particularly technology-adverse users over the phone.
0 commit comments