afdaniele/compose

A lightweight web-based CMS.

\compose\ - A lightweight web-based CMS

\compose\ is a CMS (Content Management System) platform written in PHP that provides functionalities for fast-developing web applications on Linux servers.

Born to be modular, \compose\ is built around the concept of installable packages. The built-in Core package is responsible for managing the third-party packages and allows us to install, remove, update, enable/disable packages and single components such as API End-points or Pages directly from the browser.

Features:

• Built-in support for different types of users;
• 4 types of users supported by default: guest, user, supervisor, administrator;
• Web-based package manager;
• Web-based pages manager;
• Web-based RESTful API end-points manager;
• Built-in support for Google Sign-In OAuth 2.0 authentication;
• Built-in HTTP RESTful API service;
• Error handler;
• Graphics based on Bootstrap (v3.3.1);
• and many many more...

Architecture

You can use \compose\ out-of-the-box, though there is not much to see or do until you create or install packages. \compose\ is designed to be modular with a built-in core package that provides all the functionalities needed for managing additional packages and their components. A Configuration class provides functionalities for managing settings for both the core package and other additional packages.

The RESTful API module in \compose\ offers an easy way for packages to export API end-points accessible via HTTP.

Documentation

Check the Full Documentation if you want to learn more about \compose\

\compose\ in Docker

\compose\ is also available as a Docker image.

Build your own image using Dockerfile

You can download our Docker files from (here)[https://github.com/afdaniele/compose/tree/master/docker]. To build a Docker image from one of our Docker files run:

docker build -t <image_name>:<image_tag> .

Pre-built Docker images

You can find the list of pre-built images on (Docker Hub)[https://cloud.docker.com/repository/docker/afdaniele/compose/tags].

Run image with \compose\ outside the container (suggested)

Run

docker run -itd -p <PORT>:80 -v <COMPOSE_ROOT_HOST_DIR>:/var/www/html afdaniele/compose:<IMAGE_TAG>

NOTE: <COMPOSE_ROOT_HOST_DIR> is the path to the directory on the host that contains the root of the \compose\ repository. This path should contain a public_html dir.

Run image with \compose\ inside the container

NOTE: All the changes made in \compose\ will be saved inside the container. If you delete the container without committing, all the changes will be lost.

Run

docker run -d -p <PORT>:80 afdaniele/compose:<IMAGE_TAG>

compose's Issues

no check for access_level

In web-api/index.php, it seems that nobody is checking $action['access_level'] against Core::getUserRole(). Investigate this.

TODO: try to run an administrator-only action while logged as a simple user and see what happens and in case who/what complains.

child_pages

Website compose.afdaniele.com, the page build_markdown from the package doxygen does not have a menu entry but qualifies as child_page of the page docs. The menu entry of the page docs does not highlight when build_markdown is visited.

API Service `duckiebot` accessible to everybody.

All the API calls to the duckiebot API service are open to the guest user to avoid PHP session lock. Fix this when the PHP session lock is fixed.

Enable CORS for scripts and REST API

API via HTTP when SSL Redirect is enabled

It looks like API calls with App ID/Secret do not work on HTTP when HTTPS is enabled.
The server returns app_id is mandatory. Maybe the arguments are not forwarded to HTTPS.

No `/` at the end of the paths

Make sure that we remove the symbol / at the end of all the paths stored in configuration.json.

Something wrong with the results counter in TableViewer

If you pass page=0 to a page with a TableViewer object, the results count will go negative.
For example, in the page aido_dashboard:submissions, with page=0, I see

Results:
( -9-6 )  |  16 total	

configuration files saved without formatting values

The configuration file for the core package (and I guess the others packages too) are dumped with the values not formatted according to the metadata of the configuration.

For instance, the file metadata.json of the configuration for the core package reads:

{
    "configuration_content" : {
        "maintenance_mode" : {
            "title" : "Mainteinance mode (NOT YET IMPLEMENTED)",
            "type" : "boolean",
            "default" : false,
            "details" : "Whether the platform is in maintenance mode"
        },
        . . .
    }
}

whereas after pushing a new configuration from the browser, this is what the file configuration.json looks like:

{
	"maintenance_mode": "1",
	"navbar_title": "Welcome",
	"logo_white": "http:\/\/compose.afdaniele.com\/images\/compose-white-logo.svg",
	"logo_black": "http:\/\/compose.afdaniele.com\/images\/compose-black-logo.svg",
	"admin_contact_email_address": "[email protected]",
	"cache_enabled": "0",
	"guest_default_page": "login",
	"user_default_page": "profile",
	"supervisor_default_page": "profile",
	"administrator_default_page": "profile"
}

It is clear that maintenance_mode should be formatted to be true rather than 1.

Name parameter API Service 'duckiebot'

When the Duckiebot name has numbers at the end, the name parameter is declared as 'not valid'

Incompatible Package should not provide update option

For packages that already exist in the package directory. If it is an incompatible package, it should not prompt the user to update, but rather uninstall only.

Full documentation link not working

Hello! I no longer need the documentation myself but I figured I'd give you the heads up that the full documentation link on the README (http://compose.afdaniele.com/docs/latest/) is not working and just redirects to your home page.

Cheers!

Auto-Error: #1542006137

Error reported at 2018-11-12 07:02:17 GMT.

Error message:
An error occurred while talking to the challenges API. The server returned the code <strong>500</strong>.

Infinitely expanding cache pie charts

In the Settings page, opening and closing the Cache section multiple times will have the effect of expanding the canvas size of the two pie charts.

Error loop

When an error is thrown (i.e., Core::throwError()) but there is no message, the error page will refuse to render and redirect to the default page. When the default page generates the error (with no explanation) a weird loop situation arises.

A possible solution would be to change the error page so that a default error message is shown when there is no message.

Package Store cancelling a scheduled update turns into uninstall

If you select a package for an update in the package store and then you click on cancel, the action turns into a uninstall for that package.

Package Store Version Comparison Logic

For package store package version comparison, devel should be always larger than any available version and should not prompt for update.

Google Sign-In Client-ID for docker

When running \compose\ in docker, it would be useful to read the Google Sign-In Client-ID from an environment variable.

Permission issue does not allow to create config file

If we install compose in a directory that does not belong to www-data (very common when the code is mounted from outside a Docker container), compose cannot create the configuration file for the core package at boot. This prevents the default value of maintenance_mode from metadata.json to be written, and the user is redirected to maintenance since the default value passed to Core::getSetting('maintenance_mode', 'core') is true.

We either show an error in this case or make it easier for the user to figure out what the issue is. Perhaps, we could use the entrypoint script to check and notify the user somehow (on-the-fly written page?).

Disabled pages are still accessible

It is possible (smoehow) to access pages that are disabled.

Add loading image to setup page

Every time we confirm a step in setup/, the page reloads up to the tab we confirmed, then stops for a while and reloads to the next step. Add a loading gif to the body of the tab for this intermediate load. This will show that something is happening.

PHP Session lock

Use session_write_close(); to suspend the session, save the file and release the lock for those API calls that do not change the $_SESSION variable. Add a boolean parameter 'read-only' to web-api-specification.json for each action.

Codebase provider not compiled in Settings page

In Settings, Codebase tab, the code provider shown is http:////.git. Something is wrong with the way *\compose* is retrieving the origin from git.