juku / jukucms Goto Github PK

Pagerights

Add option to auto upgrade HTTP request to HTTPs (redirect?).

Description comes later.

We should support custom content-type per page (sended in HTTP header).

Groups & permission System.

• create table permission_category
• create table permissions
• create table group_rights
• create table user_rights
• implement group rights
• implement user rights
• create api to check, if user has right

We should add an api to send mails.
This api should support SMTP mail and also php mail function. In global settings user can choose which option is used.

Supported mail types:

• plain text mail
• html mail

Package: com.jukusoft.cms.mail
Class (example name): MailApi

Methods (example):

• sendPlainMail ($to, string $subject, string $content) : bool
• sendHTMLMail (...) : bool

Important! Plugins should able to add options!
It should be possible to send mails to more than one user.

Other packages & plugins should use this api to send mails from board.

Currently events are supported, but not executed. We should implement this.

Validator for integer

Add option to allow page redirects on page, e.q. if page alias starts with "redirect:".
There is also a column "redirect_code" (301 / 302) for this feature in database.

Logout

Api for https://uptimerobot.com/

Configure Session TTL

Page Content isnt shown in template varibale {CONTENT}.

User System

Validator for usernames

Add global settings as a key-value-store as package com.jukusoft.cms.settings and create database table in db-repair.php .

Module / Package : com.jukusoft.cms.settings
Class : Settings (system/packages/< Package Name >/classes/settings.php)
API (static methods) :

• set (string $key, $value)
  • Maybe we should serialize the data
• setIfAbsent (string $key, $value)
  • Maybe we should serialize the data
• get (string $key, $default_value = null)
• create ($key, $value, $title, $description, ...)
• delete (string $key)

Cache all settings in one cache File!
(All settings --> Key-Value-Array --> Cache::put())
On first get() call all settings should be loaded once from cache and stored into a local, private static variable.

Table :

• key (VARCHAR 255, Primary Key)
• value (TEXT)
• title (VARCHAR 255)
• description (VARCHAR 600)
• visible (int 10, Can user see the value of this setting on settings page)
• changeable (int 10, 0 - false, 1 - true, is user allowed to change this setting on settings page?)
• visible_permission (VARCHAR 255, permission token, more than one token with OR can be used e.q. "can_see_settings|can_change_settings")
• change_permission (VARCHAR 255, permission token)
• owner (VARCHAR 255, values: system, package_< Name >, plugin_< Name >, style_< Name >)
• order (int 10, for settings page)
• icon_path (VARCHAR 600, default: none)
• last_update (TIMESTAMP, ON UPDATE CURRENT TIMESTAMP)
• category (VARCHAR 255, name for tab on settings page)
• activated (int 10)

Description comes later.

Currently mobile detection is not really fast.
Maybe, we can improve performance with cookies in class Browser (package: com.jukusoft.cms.browser).

@PascalReintjens german comment:

Wir sollten dann vielleicht im Interface darauf hinweisen dass dieser Selektor-Typ Performance-Einbußen mit sich bringt. Vielleicht würde es auch Sinn machen das nur einmal zu testen und einen Cookie abzulegen

Set configuration for sessions for better security:
http://php.net/manual/de/session.security.php

If CMS is installed in a sub directory and not in root directory of domain, we should add a base_url, so urls are generated in a form http(s)://<Domain><Base URL><Page>.
By default, base_url should be "/". If CMS is installed in a sub-directory, it should be "/sub-dir/".
Without Base_Dir option all generated urls are wrong, if CMS is not installed in root directory.

Btw, the base_url should be depend on domain.

User Counter Plugin

If someone edits a page, the page should be locked, so other people cannot edit this page on same time.

Joomla uses also locks, but wordpress doesnt (?).
How does wordpress handle this?

Maybe the user is hosting this CMS on another port than 80 or 433 (e.q. 8080), so generated urls should be corrected.
We should support a specific port for every domain, if user wants this (optional).
See also #49 .

Maybe we should also support LaTeX as pages.

For login / registration a ldap support will be nice.
http://php.net/manual/de/book.ldap.php

Depends on #187 .

A task schedular will be a nice thing.
Taks should be executed on end of page or by cronjob.

Package: com.jukusoft.cms.tasks

For global settings page a datatype for every setting is required (add new column in database and in Settings::create() method) so that settings page can show correct input field (e.q. text field oder select-box) and can validate data.
Every Datatype should get a own class.

Implement group members.

List with free templates:

• https://musefree.com/

test

Provide a api to get country of IP.

• https://github.com/willscott/ip2country
• https://db-ip.com/db/#downloads
• http://www.ip2country.net/

Add a reset password function, so a mail is sended to the user with a password reset link.
This feature should be included in package com.jukusoft.cms.user. Also add a global setting so user can choose if passwort reset is allowed. Maybe we should also implement a permission, so only specific accounts can be resetted and some not (e.q. administrators).

Login

We should profile twig template engine, so maybe we can replace xtpl Template Engine with Twig.

Registration Mail Verification

Show memcached stats in admin area.

Menus should have permissions, so they are only shown, if user has permission.

Registration

• create form (with custom fields)
• validate form
• Captcha class (add setting)
• send verification mail #41
• create user

For browser caching we should support E-Tags.

Validator for IP address

User Counter Plugin

Create a new PageType "Error404Page" (extends HTMLPage) and set header to 404 not found in method setCustomHeader().
http://php.net/manual/de/function.header.php

Whenever a new password is set, it should be checked against the haveibeenpwned.com Pwned Passwords list and rejected if the password appeared in a data breach: https://haveibeenpwned.com/Passwords

Detailed information (including API endpoint and implementation suggestions) here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/

Plugins should be able to add custom registration fields.

Group System

We should add HTTP cache control for proxy servers, so proxy servers dont cache html pages static (no dynamic content will be available, if they are cached static).

http://php.net/manual/de/function.session-cache-limiter.php

Add support for global and local meta tags.

Write CMS architecture to wiki.

• Styles (Templates, /styles/)
• Plugins (system/plugins)
• Core
  • Kernel (system/packages)
  • Micro-Kernel (system/core/classes)

In addition to HTML pages we should also allow markdown pages (e.q. for wikis).

Plugin Developer Guide