Cashtrack goes live! My first SilverStripe Site

April 29, 2009 at 7:09 pm · Filed under web applications

I’m delighted that I have my first SilverStripe website under my belt that I developed from start to finish. I find it quite frustrating these days that I only get to do bits and pieces of websites, add modules, modify code etc – seems I only ever get asked to the hard bits! The same holds true for SilverStripe: I have been working with it for several months now, developed modules, modified sites and other odd jobs, but never a complete site.

But at least all the bugs in Cashtrack.co.nz are all 100% mine! I worked with the very talented ladies of Decisive Flow on this project: they provided the fantastic design of the site, and I tried not to ruin it too much as I combined it with the Silverstripe development :)

Cashtrack is a pretty simple website (hence my ability to do it on my own!?), it lets New Zealanders enter the serial number of their note and little about where they picked it up etc. As the database grows, I think it will become a really interesting site that can might go in directions we haven’t thought about before.

I’m already thinking about some of the reports we could run: Where in New Zealand do people have the most $100 notes? What dollar amount has the site tracked so far, etc. 

We stuck with the philosophy of keep it simple at the start and adapt the site as required over time. I think it is the best policy for a site like this as it lets the site direction be guided by how users interact with it.

So best of luck to Rupert with the site. I certainly enjoyed doing the web development with SilverStripe and the development framework, Sapphire.

Almost finished my next big SilverStripe project too!

Comments

Remove the SilverStripe generator meta tag

March 30, 2009 at 4:05 am · Filed under web applications

Oh dear, SilverStripe 2.3.1+ now has an updated meta tag function that has a “generator” meta tag which includes detailed version numbers of the CMS. Eg for version 2.3.1, it has the text: “SilverStripe 2.3.1 – http://www.silverstripe.com”. Take a look here as to why I think this is a bad idea.

This is a real pity, and not something I want to have in a production website. SilverStripe is a great CMS and development framework and deserves praise (as does the web development company behind it, SilverStripe), but not right down to the release number!

Removing the generator tag is pretty straightforward:

  1. Open the Page.ss for your theme. Eg for blackcandy, open /themes/blackcandy/templates/Page.ss
  2. Remove this function call: $MetaTags(false) (could be $MetaTags(true) either)
  3. This prevents the generator tag from being output, but it stops a few other meta tags too, so I suggest you add the following to your Page.ss in the <head> section:
    <title><% if MetaTitle %>$MetaTitle <% else %>$Title <% end_if %>- MyWebSiteName</title>
    <% if MetaKeywords %><meta name="keywords" http-equiv="keywords" content="$MetaKeywords" /><% end_if %>
    <% if MetaDescription %><meta name="description" http-equiv="description" content="$MetaDescription" /><% end_if %>
    <meta name="generator" http-equiv="generator" content="SilverStripe - http://www.silverstripe.com" />

    4. <meta http-equiv="Content-type" content="text/html; charset=utf-8" />
    <meta http-equiv="Content-Language" content="en"/>

  4. Save your file and upload if necessary. Once you flush the cache, your should see the changes

Now you might notice that I did slightly more than just meta tags there: I also updated the <title> tag. The $MetaTags function call I removed can output a title tag if $MetaTags(true) rather than false is set and you have a meta title set for your page in addition to the standard title.

This is a good idea for some pages. For example, a page on a site I was recently working on was called “Home”. This was fine for the navigation label and actual on page title, but “Home – MyWebsiteName” does not look good for a window title or in google search results, so we used the meta title to set something which only appears in the meta data and not on the actual page, which was more descriptive and useful.

You might also notice I did not completely remove the generator tag. Well I do want to show my support for SilverStripe so in this particular instance I have just removed any mention of version numbers. At least you now have control over this text.

Some caveats though: my code above replaces what the MetaTags function currently does, but this may change in future so that were additional functionality added to the function, you might be missing out. It also gathers data such as the language and content-type automatically which you need to set manually in my code (if you need to change it).

I will blog again on the MetaTags function if it does change. A perfect reason for subscribing to my RSS feed!

Comments (5)

Trying ModelAdmin on for size

March 10, 2009 at 7:56 pm · Filed under In General

I have lately been doing quite a bit of work using the SilverStripe CMS, which also has a built in development framework, Sapphire. This is the open source child of SilverStripe, a local company here in Wellington.

Version 2.3.0 of SilverStripe comes with a stable version of ModelAdmin, a really handy new tool I have been playing with in the CVS version prior to release. You can see a video of Ingo Schommer from SilverStripe giving an overview of ModelAdmin here. He also has the bones of the presentation up on Slideshare which isn’t as long but you don’t get to have Ingo’s germanic voice caress your ears.

Issues:

HTMLText fields

Modeladmin does not seem to like HTMLText dataobject fields at the moment and their corresponding form field types, HtmlEditorField. In my local WAMP this causes an page to pretened to load for eternity (though I gave up after about 90 secs so cannot fully confirm the eternity thing…).

I don’t see this as a major issue: html fields are best suited to the Site Content tab where all that stuff currently takes place anyway. There seems to be a bug report in for this issue anyway.

Scaffolding

ModelAdmin makes it super easy to give your data a CRUD (Create, Read, Update Delete – thanks Ingo!) interface.  If you have a dataobject with defined relationships (has_one, has_many or many_many), ModelAdmin will create these as drop down lists in your create/edit forms right off the bat.

This is super but right away I noticed a problem: these drop down lists for component dataobjects have no sorting on them. Thus my list of 2,500 New Zealand towns was not in alphabetical order. Far from ideal.

You can work around this by defining your own form via a getCMSFields function for the dataobject.  This allows you to populate your drop down fields via DataObject::get, allowing you a much greater level of control. 

Tip 1: make sure you define it as a new fieldset: $fields = new FieldSet();
Tip 2: use fields->push: $fields->push(new DropdownField(‘MyDataID’,'My Data’,$MyArray->toDropDownMap(‘ID’, ‘Name’)));
Tip 3: See I used  MyDataID as the field name where the field is called MyData. This had me confused for a bit as ModelAdmin was not capturing the input when I was calling the field MyData.

Assuming you avoid the pitfalls I made above, you can create a dataobject, set it up in ModelAdmin, and in 5mins have a back end administration area for your new data object. Fantastic!

Quite often when I encounter these types of “one size fits all” dataobject management tools, they always lack just enough to put you off using them, but I think ModelAdmin passes with flying colours. It is already being tried out in two websites under development.

Comments (1)

The lock on my door is a Yale Model AG34

September 14, 2008 at 9:47 pm · Filed under security, web applications

door lockNo, I don’t suppose that is the first thing you are going to tell a perfect stranger now is it? How about someone who has just called to your door? More unlikely still.

The Rant:
Which is why it really annoys me that some web applications insist on vanity tags displaying to the world what software system you are using, and worse still, sometimes it shows what version you are using!

Just what is required to execute a zero-day attack on your poor little website. Or indeed make it far too easy for evil minded people to find sites running out of date software.

Is it on your site?
Examine the source code of your web page. It will be between the “head” tags at the top of the page. Take for example the screenshot of the html code on a blog I visited the other day. You can clearly see from the generator meta tag that not only is the blog powered by Wordpress, but it is running version 2.5.1. In this example, the blogger is probably fine. There are a couple of security fixes released since Wordpress 2.5.1 was out in July, but none that I would rate as vital. But is it really a good idea to let the world know:
a) what web application you are running?
b) what exact version you have installed?
wordpress generator meta

The cure
Now, I was going to go into a big rant about just how pointless I thought the generator meta tag was anyway, but I have to decided to bite my tongue and concentrate on the real evil: including the version number.

This is just plain old bad idea. I was really annoyed to see it creep back into the Wordpress blogs I manage recently as the location has been switched from the wordpress header template file to the Wordpress internals (from Wordpress 2.5 on). So even if you thought you had removed it, if you upgraded to 2.5 or later, it might be back in there again!

There is a relatively easy way to remove it again however, and this should be permanent unless they change this again in a future major version release.
Add the following line to the functions.php file of your Wordpress theme:
remove_action('wp_head', 'wp_generator');
(within the php code tags)

For other web applications, you may need to check the documentation or search the support forums for answers on how to remove the generator tag.

Comments (1)