Re: [stellation-res] help with php

["Mark C. Chu-Carroll" <mcc@xxxxxxxxxxxxxx>]

On Sun, 2002-11-24 at 13:37, Dave Shields wrote:
> Does anyone out there know php? I'm trying to put together a nightly build process, and it 
> turns out eclipse.org uses php to manage downloads. 
> 
> If you try to download a file from eclipse.org, you will see it is done via a file named 'index.php'.
> I was unable to get my browser to view the php source, so I need some help putting together a php file
> we can use to manage Stellation downloads. I think we have to go the php route due to the way eclipse.org
> is managed. As Mark explained it, whenever you view a page at eclipse.org, the source is actually checked
> out via CVS and then displayed.

ViewCVS and PHP don't mix. We can't use any PHP in our Eclipse website.

The way that PHP works normally is that you configure the website so
that when it receives a request for something ending in .php, it will
run it through the PHP interpreter before sending it. When you're using
ViewCVS, you're using an elaborate perl script that receives and handles
the requests. Within a ViewCVS managed space, things like PHP don't
work, because the normal request handling mechanism has been captured by
another agent.

Also remember: the Eclipse people are *very* paranoid about
administrative issues on their machines, and for good reason. They're
getting *millions* of hits per day, *and* they're trying to maintain the
safety and security of all of the projects hosted on eclipse.org - which
include projects that are the core of major commercial projects by IBM
and others. They're legitimately quite paranoid about anything that
has the potential to compromise that carefully managed security.

Allowing dynamic content scripted in PHP by people outside of the
control of the Eclipse.org administrators is simply an acceptable
risk. So even if we weren't living in ViewCVS space, we probably
wouldn't be able to run PHP. (Does SourceForge allow PHP in the 
hosted project sites? I don't think so, but I'm not sure. It's a 
similar issue.)

What problem are you trying to solve? To provide a downloadable package,
all we need to do is put it on the site, and provide a link - exactly
the way we provide for downloads of things like the publications.
There's no need for any fancy dynamic content script systems like PHP.



> By the way, it turns out php supports SQL, so it should be possible in the long run to do some
> very interesting things once we have Stellation up and running. For example, when you download a file,
> why not keep track of the number of downloads, so it can be reported, list bug reports filed against
> the file since it was made available, and so forth, all of which seems possible using SQL from php
> to access repositories maintained by Stellation.

I wouldn't go along with that. Even when we get permission to run a
Stellation server on eclipse; allowing a cribbed together scripting
language unsecured access to the database hosting the Stellation
repository is not a good idea. 

We should eventually implement bug tracking integrated with the
repository. It's one of the things that I hope we'll be able to do
with the aggregate system that we're working on. But we should do it
right, securely, using the repository itself, not through a back
door into the database with PHP. 

	-Mark

-- 
Mark Craig Chu-Carroll,  IBM T.J. Watson Research Center  
*** The Stellation project: Advanced SCM for Collaboration
***		http://www.eclipse.org/stellation
*** Work Email: mcc@xxxxxxxxxxxxxx  ------- Personal Email: markcc@xxxxxxxxxxx