« first day (525 days earlier)      last day (4426 days later) » 

1:00 PM
hehe .. i could point you to one ACL topic in SO site .. but i wont =P
i still need to fix that pageController answer :(
 
@tereško Why not? =)
About the service layer being a model wrapper.
 
11
Q: ACL implementation

KirzillaFirst question Please, could you explain me how simpliest ACL could be implemented in MVC. Here is the first approach of using Acl in Controller... <?php class MyController extends Controller { public function myMethod() { //It is just abstract code $acl = new Acl(); ...

and the service layer is not just a wrapper for model
 
With that I feel I'm doing right. ZendFramework docs doesn't have any mentions about services, and Symfony docs just a few lines about "Controllers as Service"
 
hell .. there isnt such a thing as "model class"
 
Nor an interface?
model layer I mean
 
1:02 PM
yes , and it wraps the data access object and domain business models
but service layer also adds other services which are not related to model layer
 
Yes! It is what I was expecting
@tereško Exactly, like a the Twitter Service for instance
 
like authentication and mailing
 
or any third party service
Indeed
 
i prefer "3rd party components" or "3rd party libraries"
 
So, for the service layer, I think I'm doing good so far. I'm not relying on controllers to perform such tasks
 
1:04 PM
and , do not confuse authentication with authorization
 
Hiho
 
@tereško Well noticed, thanks
 
hi @edorian!
 
long time not see, @edorian
 
Well, authorization you mean ACL?
 
1:05 PM
yes
 
So how are things around here ? :)
 
So far, all my service's methods are protected and overloaded. So when calling $userService->createUser($data); it will first check if the user is authorized to do such then forward to the _createUser protected method
 
read the comment in that topic i linked
start with on from @hakre
 
@edorian Hi. A lot of questions, I think =P
@tereško Okay
 
@hakre How's life?
 
1:10 PM
@tereško As for the ACL's question. The common way would be a plugin hook for the controllers.
 
@edorian I hope better soon, I'm curing my illness which sucks because of the weather.
 
no sure what you mean with "common"
 
Well, my first applications using ZF used ACLs based on URLs, so I hooked it up on the preDispatch().
No my ACLs are based on the service's available methods
It's more likely this answer:
http://stackoverflow.com/a/9685039/260610
 
I start to write spaghetti code soon again. It came to my attention that the code is actually easier to maintain and easier to test then a zend framework application.
 
@hakre spaghetti? hmm... I don't think so... Do you mean in-house framework or something alike?
But to me spaghetti is a mix of php and html. Like fat views with echo "<tags here>"
 
1:16 PM
@tereško: You answer did undergone the one or other update. nice.
 
Your answer @tereško =)
 
but it has nothing to do with hooks >.>
 
So. I'm doing as you proposed. I have the abstract service that calls the acl with overloaing
hooks are for basic acls based on urls... not my case
 
11 mins ago, by Keyne
So far, all my service's methods are protected and overloaded. So when calling $userService->createUser($data); it will first check if the user is authorized to do such then forward to the _createUser protected method
this means , that to check if you can access service, you are using the service
essentially you are adding another responsibility in that service
 
No. This means that my AbstractService overload to check it automatically
 
1:20 PM
confused
 
Well. It's almost the same as your answer. My service has the __call() as yours secured container
But instead of call the controller it calls the protected method.
Since the __call in on the AbstractService
In my controllers I can simply call $this->serviceLocator->users->create($data)
in the code about, the 'users' is the UsersService
It will throw a Access Denied exception if the user is not allowed. But I will only provide the link to the controller action if the user is allowed. So this will only happen (the exception) if the user try to change the url manually.
Got it?
I meant: In the code above, not about =D
 
Have you seen this lecture : youtube.com/watch?v=RlfLCWKxHJ0
 
Not yet. But will see. What's the main point?
 
it explains dependency injection
your abstract service has too responsibility : authorize user and do the actual service work
 
Hey guys
 
1:30 PM
Oh! Dependency Inject would be my next step. But for now it's everything going well with out it
Either way, considering my service as the boundary for the model layer. I think it's good
Dependency Injection would just give the ability to chose different components, but the ACL check itself would remain the same
For now, I don't need to choose between the available components for authorization. One is good =)
So I'll let this job of using DI for another time
 
watch the video
i get the nagging feeling that you are misunderstanding the goal of DI
 
hmm... Maybe
 
maybe it's just the intuition mis-firing
 
I'll watch as soon as I go to a faster connection (I'm on a slow mobile connection now)
 
youtube has this nice "watch later" list
 
1:35 PM
lol
In my conception DI is for loose coupling
 
@edorian: What's cooking?
 
Nothing much. New work takes up a lot of my time and focus
Gaming & minor phpunit maintaince does the rest
Zürich is great so. Lots of new phpeople
 
@tereško So I would not mind to have ACLs tied to services since it's intrinsically part of the model layer
 
Hey there, long time no see @edorian
 
By tied I mean, the calls to check it
 
1:40 PM
@ircmaxell Hiho. Nice blog posts
 
But I got your point of a separated container on your answer.
 
The best way I've found to handle ACL is to decorate the model. That way, it's not tied to the model object, but instead still has access to determine access on a method by method basis
 
morning
 
Thanks, I've got a few more good ones in line
 
@edorian , i think he (@ircmaxell) is just make excuses so that he didn't need to write a book
 
1:42 PM
@tereško I am writing a book
 
@ircmaxell Agreed. Like the @tereško answer here:
13
A: ACL implementation

tereškoFirst part/answer (ACL implementation) In my humble opinion, the best way to approach this would be to use decorator pattern, Basically, this means that you take your object, and place it inside another object, which will act like a protective shell. This would NOT require you to extend the orig...

 
yup
 
A book about php internals is sure to sell 50 copies. Maybe 150 :P
 
@ircmaxell As I stated, the only difference is that that __call is under my abstractService:
0
A: Best way to implement a web MVC application (language agnostic)

hakre Should controllers implement business logic? That depends on your design and style of doing things "your" MVC-way. As you're designing a framework you should probably allow both to keep the usage of the framework flexible. Taking a closer look on your code examples I'd say you're only shift...

 
@Keyne which makes it not a decorator, and screws your inheritance hiearchy
 
1:43 PM
@Keyne , difference is that you are trying to make the ACL a part of service
and you are even doing it by way of inheritance , which makes it worse
 
hmm...
 
@edorian 'Actually, that's not the book I was talking about. But I want to take our blog posts and turn them into a book (free possibly, or sell for very little)
 
@ircmaxell something along the lines of eloquentjavascript.net ?
 
@ircmaxell Yeah I know you where not doing that. I was just saying to myself "well.. someone should as the only other book is quite outdated"
 
Yeah, that kind of thing...
 
1:45 PM
you can read it online, but you can buy a dead-tree version
 
but tbh. blogging about it seems more useful
 
@edorian Well, I don't want to write a PECL Extension guide book.
I want to write an intro to the internals for PHP devs, as I think that's way more useful. There's topics out there to learn PECL extensions. There's not much as to a guide for those who don't know C...
But, I have to run
 
If it's not written by rasmus it's not going to sell more than 100 copies in 2 years so it's not really worth the effort
 
take it easy
 
@Keyne , always remember this rule of thumb : "composition over inheritance"
 
1:46 PM
@tereško @ircmaxell I got your point now. I'll think more about it and check the best way to change my current code.
 
have fun :)
 
@edorian Which is why I'm not doing it to make money, but more to get the concepts out there.
 
I'm late to discussion, what are you writing ircmaxell? Got a link?
Sounds interesting either way.
 
fuck , i lost one of my youtube accounts
 
@tereško I got it now. I'll plan the changes I need and if I got stuck. I come back to post here. Will use the decorator instead.
Sorry for your youtube account lol
 
1:52 PM
the trick with decorator is that you can use it on any object
 
Good point. I'm seeing that now
 
hi guys,
select * from list where BulkStatus = '1' and (LastCheckForBulk < '2012-03-17 15:29:28' or LastCheckForBulk is null) limit 9
anyone can tell me what is wrong with this query
field is like LastCheckForBulk timestamp NULL default NULL,
 
@tereško can you tell me how to detect audio support in a browser using JS? I'm trying to detect support of the Audio() object in Chrome
@tereško Is a simple window.Audio the correct way?
 
sorry , have no clue , you should ask in JS channel , the best i can do is is suggest to look at canPlayType()
 
Does a query like this, completely protect from SQL injection?
$sql = 'SELECT *
	FROM members
	WHERE email = :email AND password = :password ';

$sth = $db->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY));
$sth->execute(array(':email' => $email, ':password' => $password));
 
2:03 PM
@tereško np. will do
 
@HarryBeasant , to some extent
 
@tereško What could get around it?
 
but you would be better of , if you used bindParam() and set the max width for the string
 
also , there is no point in selecting based on password in WHERE statement from DB
 
2:05 PM
Its for a login
I then have count rows
 
lol ?
 
Okay, this is irking me:
> PHP Fatal error: Class 'mysqli' not found in /var/www/seoscheduler/public/seoPhp/dbInterface.php on line 7
 
isnt email a UNIQUE field ? @HarryBeasant
 
why do you need the additional condition :?
 
2:06 PM
because i have to check that the password is correct lol
The email and the password have to match
otherwise you cant login
 
no
email has to match , but password's salted hash must match the hash stored in database
 
yes i have that
$password = salted and hashed
$rowCount = $sth->rowCount();
 
MySQL does not have crypt() function
 
if ($rowCount > 0) { //login}
md5 then salted with two random strings
?
 
@tereško Which additional condition are you referring to?
 
2:09 PM
md5 , which has low entropy , with two strings that never change .. this add no entropy at all
@Keyne , the password
@HarryBeasant , you should be checking the hash at the php end
 
Yes, he needs the password's condition. So... the point is actually the salt?
 
Yes, exactly, without the password condition is wont work
But, i see what you mean about the salting
Its not crazy secure
 
Please explain what you mean about the password field
 
@tereško lol
 
2:12 PM
first of all why the hell you call it PASSWORD !! if it actually is a hash
second , each password should be hashed with an unique salt , using crypt() function
mysql cannot perform it
 
does it matter
 
First of all the first question is answered.
 
the string inside $password is hashed before, you just cant see that
 
You're safe from SQL injection
The part of the hash could be another question...
@HarryBeasant What @tereško means, I think, is a UNIQUE salt per user. Not a global salt.
Your table would store one salt per user and the password hash based on that
@tereško [be-patience] =D
 
2:16 PM
how am supposed to store the salts in the database
thats also insecure
 
hell, how to post tags =D @tereško
 
. . . . . . . . . . . . . . . . . . . . . . . . .
^ how I feel about PHP not being able to find mysqli
 
@LeviMorrison , are you using namespace ?
 
2:18 PM
@GordonM Yes! I thought so =\
 
:)
 
@LeviMorrison , then it is $foo = new \mysqli( ... );
 
@tereško is a bad influence! huhu
 
well .. people in three different location have given me the same nickname over and over ago .. then again , i think it has something to do with my full name
 
@tereško No, it must be how I upgraded to php 5.4
I tried to use built-in debian stuff
I think I messed it up.
 
2:21 PM
lol. @tereško I meant for the tagss, not name!!
 
Should have just compiled it myself.
 
is the mysqli extension even in phpinfo() ?
 
@HarryBeasant unsecure is to have a global salt. You should use both the global salt and the unique salt per user
 
but if the database was hacked, they'd be able to get the salt anyway
 
@tereško Dunno, resetting to defaults at the moment. I'm pretty sure I messed it up.
 
2:25 PM
If I got into your server I will have the global salt
But it's expensive to brute force a mix of passwords with a global salt plus a unique salt
 
hallo all
 
@HarryBeasant Got it?
The global salt will be on your code, and the unique salt on your database
You'll use both. Better than just one as in your case
 
additionally , crypt() uses stretching ( default is 5000 ) which makes the bruteforcing even hard
 
@HarryBeasant So go with the unique salt too!!
@NikiC Hello
 
@tereško I've made progress. I have PDO now, but no database drivers.
 
2:32 PM
@LeviMorrison Compiling PHP?
 
@NikiC Sort of. I tried using Debian's commands to do it. I think I either did it wrong or debian really isn't ready for php 5.4
Getting:
Removing php5-mysqlnd ...
/usr/sbin/php5dismod: 125: FOUND: parameter not set
dpkg: error processing php5-mysqlnd (--purge):
 subprocess installed pre-removal script returned error exit status 2
configured to not write apport reports
                                      Processing triggers for libapache2-mod-php5filter ...
Reloading web server config: apache2.
Errors were encountered while processing:
 php5-mysqlnd
E: Sub-process /usr/bin/dpkg returned an error code (1)
Trying to remove it because it isn't showing up anywhere, but I don't know how to fix something when I can't purge it :/
 
:D
I caused a big mess in the PHP repo yesterday/today
Wanted somebody to apply a simple Zend change
That led to about 20 (or more) commits :)
 
Yeah, that's the stuff that happens when you make a commit and then merge it to two branches and then make another change and merge that again and then revert it and merge it and apply a different change and merge it and then revert the commit and then revert the two merges and then messed something up and have to revert the revert of the merge and then merge again and ... oh, basically reverts and merges suck :)
 
well time to rebase I'd say + hi @NikiC
 
2:40 PM
@hakre Oh, and obviously you can't rebase because you'd cause an nff push :)
and hi @hakre :)
In any case, good that I wasn't the one doing all those commits, so I can say that it wasn't my fault :P
 
3:07 PM
@hakre can you test this on your linux machine with the error on the audioplayer of the cv-pls plugin?
And let me know the outcome
 
Detecting Audio() support...
HTML5 audio is NOT supported
 
@hakre k great. It works. Now to implement the fallbacks. tnx for testing it
 
@PeeHaa np
 
 
1 hour later…
4:30 PM
0
Q: ksort produces wrong result when dealing with alphanumeric characters

habeebperwad<?php $a = array( 'a'=>'7833', 'd'=>'1297', 'c'=>'341', '1'=>'67', 'b'=>'225', '3'=>'24', '2'=>'44', '4'=>'22', '0'=>'84' ); ksort($a); print_r($a); The above code produces t...

this must be a dupe
 
Are there any issues with GitHub atm? I just pushed something, but I cannot see it on GitHub?????
 
@PeeHaa Is it a github page?
Like, on gh-pages?
 
@LeviMorrison yup. I (think I) pushed something to github.com/PeeHaa/cv-pls/tree/dev but it doesn't show the commit ?
 
@PeeHaa maybe you didn't push hard enough :o
 
gh-pages are slow now, for some reason. I've had to wait over ten minutes at times lately.
 
4:39 PM
@LeviMorrison I don't think he meant "yup".
 
@markustharkun But I pushed as hard as I can. Perhaps I should spend more time in teh gym and less time coding ;)
 
are you sure you pushed to github?
 
@salathe yes I am (there aren't any changed files in my local repo anymore).
Although I'm still a noob (so not 100%)
 
no changed files just means you committed something, it doesn't mean you pushed to the remote repository
 
@salathe wtf!? it looks like it merged branches instead of pushing to github repo. Aaaarrrggh lemme check
 
4:43 PM
"it" ?
 
@salathe it being Git :)
 
Git only does (mostly) what you tell it to do. :)
 
@salathe I know and I was wrong (ofc) :P
So still a huge wtf!?
 
What did you do to try to push it to github?
 
@salathe I've staged my changed files to commit and pushed it to my dev repo @ github
@salathe it did ask for my key
 
4:47 PM
did you commit the staged files before pushing?
 
@salathe yup
@salathe I even got the success message
 
are you sure?
 
@salathe If I didn't commit them wouldn't they still be displayed as "Unstaged changes"?
 
not if you staged them
you need to stage the files (git add), then commit (git commit), then push (git push)
staging is just saying, I want these files to go into the next commit.
 
@salathe I'm pretty sure I did it. And when I now simply try to commit I get a warning that no files are staged to commit (if I forgot to commit shouldn't the files still be staged for commit?)
 
4:51 PM
@PeeHaa What does git status give?
 
you're on the dev branch?
 
@salathe yup
 
what does git log dev...origin/dev say?
(assuming origin points to github)
 
$ git status
# On branch master
# Your branch is ahead of 'origin/master' by 1 commit.
#
# Untracked files:
#   (use "git add <file>..." to include in what will be committed)
#
#       cv-pls.pem
nothing added to commit but untracked files present (use "git add" to track)
@LeviMorrison
It looks like local is ahead of origin?
 
hold on... On branch master
 
4:53 PM
push to origin/master
 
you said you're on dev
 
yes he said that, but that status is from master
 
he also said he'd pushed, so I don't know what to believe :P
 
Eeeeeeeeeeek
 
yeah, this keeps freaking me out: why the hell is coding like religious stuff, all this esoteric things.
 
4:55 PM
2
Q: How do I filter out Dangerous HTML like SO does?

DexterI wan to provide an HTML editor on my site, but don't want to open myself up to xss or other attacks that come with allowing user-generated HTML. This is pretty similar to what Stack Overflow does. How is the HTML checked/sanitized here so that the styling information still remains, while other,...

Glad the squad are smarter than to try and migrate this (see comments and revisions).
 
user895378
@LeviMorrison Any further thoughts on last night's directory structure question?
 
Kinda success: github.com/PeeHaa/cv-pls comitted to the wrong repo but hell :P
 
@salathe brb suspending from chat
:P
 
@BoltClock heh
 
4:57 PM
I knew when I heard the ping
 
@PeeHaa You mean, wrong branch?
@PeeHaa "cv-pls" is the repo, "master" and "dev" are branches.
 
@PeeHaa: Do you plan a release with the audio-wrapper so that I can test it on linux with the package? Or should I run against the repo?
Or should I just assume it's tested ;) (because I mean we tested it)
 
@hakre Guess what I just fucked up the pushing with? ;)
 
Anyone familiar with the DOM functions in PHP (DOMXPath in particular)?
 
@salathe sorry branch
 
4:58 PM
No idea, but please tell.
 
@GeorgeEdison I'm sure someone is.
 
@GeorgeEdison What do you want to ask about?
 
@hakre tried to push the audiowrapper to dev branch and after that i'll build the plugin
 
Okay, I'm trying to parse this page using this XPath selector: '//div[@class="parameters"]//label'.
 
okay, so you pushed it locally from one branch to the other?
 
4:59 PM
But it isn't returning anything.
 

« first day (525 days earlier)      last day (4426 days later) »