Frontend user adding - from remote software

[sune]

Hi,

I have the task to make this work, and thought that the best way to proceed would be to put a 'secret' utility file on the webserver. Then from my local software I make a http request that passes all the information needed to create a new user. For the moment, lets ignore the security issues related to this

Basically thats pretty clear, but there are some hurdles and I can think of two ways to go from here:

1. Place my utility file outside of cmsms and make it do all the mysql database updating needed to add a user. This would require me to either write a lot of code or to copy a lot of the existing code. And if i succeed I'm not sure I got it all right, so I don't like this variant.

2. Place my utility file inside cmsms which requires me to login? I have seen the file modules\FrontEndUsers\function.admin_importusers.php and think this is a good starting point to base my code on.


Is there a third way to do this? Can I log into cmsms at all if I'm requesting url's programatically (not using a browser)


Comments very much appreciated,
Sune

(version is 1.2.3)

[calguy1000]

I have successfully wrote a bourne shell script (you are using a shell script, right). that uses wget to:

1) login to CMS Made simple
2) call a module action

and I've posted about it on the forum.

So why not do something like this
1) modify FrontEndUsers/action.admin_importusers.php so that you can specify the name of the file
    in $_GET, and if not specified it searches for an uploaded file
  (this is a trivial change)
2) write a bourne shell script that:
    a) uploads file (via ftp or whatever)
    b) uses wget to login to cms made simple
    c) uses wget to call the admin_importusers.php action in FEU and supply the name of the uploaded file
    d) delete the uploaded file (optional)

[sune]

Hi again,

Thanks very much for your help. Actually I'm using C# to do this...

Inspired by your other post "Automation though wget" i managed to log in, post/upload a file with a single user to the action.admin_importusers.php file without having to prepare or change it in any way.

I cant post the actual source, but can give some clues how to do...

sUrl = sSite + "/admin/login.php";
I used the HttpWebRequest object and HttpWebRequest.GetRequestStream(); to post username and password. It is very important to initialize an instance of HttpWebRequest.CookieContainer - otherwise it will not even log in!

sUrl = sSite + "/admin/moduleinterface.php";
I used wireshark to see exactly what kind of data is posted, and it didn't work until all the form items of the submit form where included in the request (comparing to the graped network traffic when using the browser to do it). The instance of the cookie container was reused doing the second request to authenticate.
HttpWebRequest.ContentType = "multipart/form-data; boundary=" + sBoundary;

Then build the post data from a string like this
sData = "";
sData += "--" + sBoundary + sNewLine;
//mact
sData += "Content-Disposition: form-data; name=\"mact\"" + sNewLine;
sData += sNewLine;
sData += "FrontEndUsers,m1_,do_admintasks,0" + sNewLine;
sData += "--" + sBoundary + sNewLine;
...
very important that the last boundary line is like this:
sData += "--" + sBoundary + "--" + sNewLine;

Then make a byte array from the string and post it to the request stream.

From the result you can read how many records where added and if there were errors.

This actually works, wee