Missing setup doc: PHP rewrite, cron & data dir

[rugk]

You are really missing some setup steps.
E.g. you do a request /api/index.php/polls, which usually returns a 404 error as such a file (dir: /api/index.php, file: polls) does not exist.
This means some kind of server rewrite is needed. Can you say me which one for nginx?
In what format should this requests be passed to index.php. /api/index.php?polls e.g.?

Furthermore you say the cron.php should be called by cron, but there is no explanation 1) how to protect that file (server config or permissions set...) and 2) how to setup a croon job for this (most user won't even know they have to do this, because it is only said in the PHP file itself).
You also don't say what interval you would recommend for this cron task...

Finally there should also be an explanation how to protect the data directory. This is mostly quite easy.

[jelhan]

I did not tested with nginx. Apache does not require any special configuration. /polls should go to PATH_INFO. I think you could achieve this by fastcgi_split_path_info. Example in nginx documentation should work:

location ~ ^(.+\.php)(.*)$ {
    fastcgi_split_path_info       ^(.+\.php)(.*)$;
    fastcgi_param SCRIPT_FILENAME /path/to/php$fastcgi_script_name;
    fastcgi_param PATH_INFO       $fastcgi_path_info;

Could you please test? Should be documented in README afterwards.

README is a little bit outdated...

Furthermore you say the cron.php should be called by cron, but there is no explanation 1) how to protect that file (server config or permissions set...)

cron.php should protect itself by checking php_sapi_name in https://github.com/jelhan/croodle/blob/master/api/cron.php#L8-L10. Of course you could add another security layer in your webserver configuration. But if I didn't missed something it could be only used for DOS attacks.

2. how to setup a croon job for this (most user won't even know they have to do this, because it is only said in the PHP file itself)

Added some instructions to README by b7d7953. Basically it's not such important how often or even if cron.php is executed since api checks if poll has expired on every request.

[rugk]

Okay, actually it also nearly works with the default nginx config. At least one Debian the config files already have this included...