Guestbook operating instructions and setup

Overview

This is a guestbook script. It allows visitors to sign a book and leave a message for other visitors to read.

In addition to leaving a message, visitors can leave their email and website addresses too. This allows other visitors to contact them directly if needed.

The guestbook also has a password protected message moderator. This means visitor messages are not instantly posted to the book. A moderator must allow all messages to be posted and can remove abusive messages or nuisance advertising. A log is kept of all transactions and errors.

Requirements

This guestbook script requires the following to operate:

A secure password protected folder accessible by FTP and Web browsers. Named "/guestbook" for the moderator to access only. Once you have configured your guestbook, write to <support@r4l.com> and we will password protect the directory for you.

A client website, e.g.. www.your_domain.com hosted on our servers.

When you write to <support@r4l.com>, please provide the following with your request:

• The domain name for which you're requesting the guestbook set up.
• The login account password (for confirmation) for this domain.
• The username and password you would like to use for the guestbook.

Files

There are 4 HTML files needed for your guestbook. These are described below:

guestbook.html	This page shows all successfully posted messages.
addguest.html	Use this page to add new messages. New messages are sent to the moderator page and are classed as ""Pending".
moderator.html	This is only accessible by the moderator (you). It shows all new visitor messages that are pending. Reading the moderator page then allows the moderator to accept or remove messages as they see fit. Once the moderator posts a message from pending, the message then becomes visible on the guestbook page and is removed from the pending tray.
guestlog.html	Holds a record of all message transfers, errors and IP address / date stamp of action. This log is only visible to the moderator.

The actual CGI scripting file is called guestbook.cgi and is already placed in the server's CGI-BIN directory for you. You need not install this file.

Right-click on this link and choose save as for a sample set of Template files. You will need to unzip these files and then upload them once you have customized them for your own use.

Setting up these webpages for your own site

Two of the files shown above must be edited for your own domain name before uploading to your site.

Note that the Guestbook.cgi file needs no changes and your server administrator will take care of any server specific settings within the script.

ADDGUEST.HTML

Addguest pages must include a form with the header:

<form method=POST action="/cgi-bin/guestbook.cgi">

*** EDIT THESE ***

Any Addguest page must include the following hidden form fields:
<input type="hidden" name="refererdomain" value="yoursite.com">
<input type="hidden" name="guestbookurl" value="http://yoursite.com/guestbook.html">

where 'yoursite' is of course your own site address.

Also, these fields need to be present in the form:
<input type="text" name="username">
<input type="text" name="url">
<input type="text" name="city">
<input type="text" name="country">
<textarea name=comments cols=60 rows=8></textarea>
<input type="submit" name="submit">

Visitors must fill in two of these fields when posting a message; username and comments.

MODERATOR.HTML

Moderator pages must include a form with the header:

<form method="post" action="/cgi-bin/guestbook.cgi">

*** EDIT THESE ***

Any Moderator page must include the following hidden form fields:
<input type="hidden" name="refererdomain"value="yoursite.com">
<input type="hidden" name="guestbookurl" value="http://yoursite.com/guestbook.html">
<input type="hidden" name="moderatorurl" value="http://yoursite.com/guestbook/moderator.html">

where 'yoursite' is of course your own site address.

Also, these fields need to be present in the form:
<input type="submit" name="post" value="Post to guestbook">
<input type="submit" name="remove" value="Remove from pending">

The two remaining files; Guestbook.html and Guestlog.html need no changes.

Of course, all pages can be customised in anyway you like, colour, style, fonts and general page layout. But the fields shown above must be included for the guestbook to operate correctly.

File Placement on the server

The scripting file guestbook.cgi must be placed in the server CGI-BIN directory and be allowed perion to execute. This will be done by the server administrator.

The two files Guestbook.html and Addguest.html must be placed in the website's root directory. For ex on simple apache servers this will be in ../htdocs/ viewable as simply '/' to the outside world.

The two remaining files Guestlog.html and Moderator.html are to be placed in a specially prepared directory named "/guestbook/" from the site root directory.

This directory is to be accessible via FTP (read and write access allowed) but must be password protected to any visiting web browser.

If you require further information on password protecting a directory, please consult your server documentation - or ask your administrator!

The idea is to protect content in this directory. The moderator and log pages are then only viewable by the moderator who knows the access password. The server administrator will issue this password and username to you on request. Visiting clients MUST NOT be able to view content in this directory! Only moderators should be able to see these files.

Operating the Guestbook

Upon visiting your website, your visitors should be given a link to your guestbook.html and addguest.html pages.

The easiest way to do this is from your index.html page:

Visitors can then view the guestbook and add new messages if they want.

A Guestbook looks something like this:

A moderator can also use this page to login. Visitors can read all posted messages here and add new messages.

Adding a new message will show this page:

Note that the "Your Name" and "Comments" fields must be filled in by the visitor, if not, an error is displayed and the message is not posted.

A moderator page requires a secure logon and that looks something like this:

Enter your details to log into the moderator page. It is suggested that you tick the box for "use password manager" or "Save password".

This allows you to check your moderator page quickly and regularly without having to type in your details every time.

The moderator can then POST or REMOVE messages as well and view the Log page from this point.

If you have a lot of messages that need to be posted or removed, use the Select/De-select checkbox.

A moderator Log page looks soming like this:

This keeps a record of all transactions. Errors or also logged with the prefix ERR. Its worth keeping an eye on this log to see if anyone is trying to hack your guestbook. If so, the ERR will show "potential hack attack!" and you can then report the offending IP address to your administrator. That IP can then be traced or even banned.

Remember, when a message is first added to the guestbook from a visitor, they CANNOT make there message appear in the actual guestbook. The moderator (you) can only allow that message to then be POSTED to the book for viewers to then see. This stops abuse.