« first day (1076 days earlier)      last day (3871 days later) » 

7:00 AM
And it's also fast.
 
@JoeWatkins I have never used eclipse. At early stages when was writing Java was using netBeans, then moved on php and .NET so... Nothing against it, just asking.
 
I don't find it to be slow ... I use it for java, if you turn off all the validators you don't need it's pretty quick ... it's still a hog, but not slow ...
I have to use it for java, it was pre-ordained as the IDE my boss can install and understand enough about to browse code in a useful way ... but I don't really dislike it, there's a shit tonne of stuff you can download for it, make it do nearly anything ...
 
I don't dislike that part of Eclipse, it's extensible as hell.
 
@Danack I'll give it a try since I like PHPStorm very much, lighter than IDEs with the same functionality. More likely IntelliJ will perform likely.
 
it does even have pretty good autotools suppotrt ... don't know of anything else that does .. but, I never ever use it for C, pointless ...
 
7:03 AM
only thing I use eclipse for is word processing: symphony.lotus.com
then again, I might migrate soon
 
@tereško it now got merged into OOo4 IIRC. At least most of it :)
 
the php kit for it is pretty cool too ... I haven't installed it in ages ... but from what I remember covered php pretty good
 
@hakre yeah , that's the impression
as I said, migration is being considered lately
 
Mornings
 
moin @DaveRandom
 
7:06 AM
^ there is more crap we need to clean after for this user.
 
@JoeWatkins What's you impression of internals' attitude towards error reporting in PHP? I was considering last night the possibility of adding something that could be set on a per-stream basis (like a context opt or something) and in a couple of other places to disable error reporting on operations involving those specific entities, it really pisses me off that a bunch of file systems emit errors when the problem can often be silently handled in userland. Same goes for ext/ldap.
I find myself using @ a lot in both areas, I'd much rather set an option and not have to worry about it
 
good morning.
I am reading about secure webapps and just used the chrome extension "edit this cookie" to successfull avoid a login system written by myself. that system checked on cookies. now i wonder, is it posibble for an attacker to inject $_SESSION variables, too?
 
It would probably need a stream_last_error() (or something) as well. Thoughts?
 
@DaveRandom +100
 
@user2422960 The only thing that's really possible via cookie modification if you are using PHP's native sessions is session hijacking, which is where you would change the session id in the cookie. If the attacker is just brute-forcing it, it's pretty hard to do, but if they are able effect a MITM attack it's trivial.
 
7:13 AM
Just consider the behaviour of using fopen('file', 'x'); ... returning false is completely adequate, but they have to ruin it by issuing a notice.
 
It's only possible to inject session values if you are storing user input directly into the session data
@Jack fopen() is one of my biggest bug-bears
And generally things that open streams, file_*_contents() do it as well
 
You learn to live with it I guess.
 
@DaveRandom
so, can we say that if i never check the sessionid itself, but instead create a session variable like isLoggedIn which is only created if the user is correctly logged in with his password, there is no chance for a hijacked session?
also, excuse my english
 
It would also be advisable to regenerate the session id to avoid session fixation.
 
@DaveRandom error management is a bit of a mish-mash of compromises ... there's sometimes talk of changing it ...
 
7:17 AM
@Jack
I have objections to your patch
 
@Jack On every request or on privilege change?
 
@LeviMorrison Okay.
 
It's not that you did anything wrong
 
@Jack Well I've just written a wrapper around ext/ldap. And pretty much every call to an ldap_* function has an @, because it emits errors at every opportunity, but I'm really unhappy with it, even unhappier since Niki's gist on operand evaluation order yesterday - and it got me to thinking that the main reason I don't want to remove them is because I don't want any global error handlers to hear about things that are going wrong.
 
@Leri On privilege escalation.
 
7:19 AM
@rdlowrey :D
morring
 
It's just that I want to propose filter that works on arrays, traversables, etc and works with keys and values.
 
morning @LeviMorrison ... missed your last question about anon classes last night ... yeah it's understandable that you cannot really envisage ways to use it, because it doesn't exist right now ... anonymous and nested classes are something that no language really needs, but are useful to have in the toolbox all the same ...
 
@LeviMorrison Yeah, and not just for filter()
The way that map() was implemented is just rubbish imho; probably as a way to deal with the lack of anon functions.
 
@JoeWatkins It is a hateful concept. Either throw me an exception that I can handle locally and log if I want to, log it if it goes unhandled, or return an error status and let me fetch the message myself if I want it. It's an uncontrollable global state, the way it stands
@user2422960 What do you mean by "check the session ID" exactly?
 
Yeah, I plan to have map, filter, and reduce at a minimum.
 
7:21 AM
Morning
 
@DaveRandom some time ago I wrote a patch to manage better errors at the level of C, by stacking error handlers and delegating to them upon error ... it was interesting, and I wrote it because we were talking about it ... but I'm not sure if it would ever be merged, poor error handling is so deeply ingrained in PHP, it's kind of too late ...
 
@DaveRandom
i mean, i could either look for isset($_COOKIE['PHPSESSIONID']) or instead for $_SESSION['isLoggedIn']
the sessionid itself would be injectable, but the boolean not. is this correct?
 
good morning everyone
 
morning @Starsong @DarkAshelin
 
@JoeWatkins That's why I'm initially just looking to localise it and make it optional by attaching a setting to one of those sprawling lumps of state known as a "resource". That way a) the changes are optional for the user and completely BC and b) it's a lot easier to implement and a much smaller change (can probably be done just by wrapping the error trigger calls in a(nother) macro)
 
7:24 AM
hmm .. buying a watter kettle with adjustable temperature was a really good choice
 
isn't there a reason we boil water ?
 
well .. if you drink green tea, then you need 70°..75° range
 
didn't know that ...
 
@user2422960 hah, I thought I was the only one using $_SESSION['isLoggedIn'] instead of $_SESSION['user']
 
@JoeWatkins if you put green tea in hotter water , the leaves get scorched and it tastes like crap
 
7:27 AM
@user2422960 Oh I see what you mean. Don't ever worry about isset($_COOKIE['PHPSESSIONID']), let session_start() worry about that for you, you just use $_SESSION. The kind of checks you'd need to implement to prevent session hijacking are things like checking against $_SERVER['REMOTE_ADDR'] - but that's where it starts to get very complicated, because people's IP addresses can legitimately change in the middle of an active session
 
@DaveRandom if you are working with $_SESSION["user"] for rights is it recommended to do extra checks for security?
 
@tereško Yeh my gf is always bitching at me about that. Same with coffee. I don't drink either so I can't really comment.
 
Hey @JoeWatkins
 
@DarkAshelin E_MISSING_CONTEXT
 
@DaveRandom uhh, checking if user is admin for example, for setting rights
 
7:30 AM
It certainly isn't good enough to just assume that because you have a session which has $_SESSION['is_authenticated'] set to true then the user is legit.
I should point out right here and now though that I am no expert in this particular area, so you shouldn't listen to anything I say
 
in this case $_SESSION["user"] would be an object or array including username, status (admin or normal user)
 
In general, if you want security, use HTTPS.
 
thank you so far, i guess im beginning to understand. what baffles me is what e.g a user said on SO: http://stackoverflow.com/a/7616283/2422960

i do not understand how an attacker could steal another ones session just by guessing his sessionid. let's guess the attacker successfully injected another users id, but my application does never check for that id. instead, it looks for $_SESSION['isLoggedIn'], whic is created on login-success
 
Just use HTTPS. A cheap signed cert is about $10, there is no excuse to ever not use it.
 
@Starsong $10 ain't worth it for every project
 
7:32 AM
keeping that much information in a session doesn't scale, at all, doesn't scale past a single machine ... I have things to say, but school run ... back soon ...
 
@DarkAshelin Yes it is, even the padlock being there and the increased confidence of clueless users who inherently distrust sites without it is worth $10.
 
for live sites that will get used, maybe
 
If you have a project that isn't worth spending $10 on it, you have a project that isn't worth spending 10 minutes installing composer and a framework for.
 
think schoolprojects
 
@DarkAshelin It doesn't really matter what it is, what matters is that you don't implicitly trust any data in the session store as genuine. Which makes it especially tricky, since it's hard to validate data between requests without storing something in the session. Some kind of HMAC on the session data with a private key would be a good start though.
 
7:34 AM
@DarkAshelin For schoolprojects I wouldnt buy a new domain for them so they'd be using my master cert for my domain anyway.
 
morning
 
@Starsong think about a small website of the bakery next door, 3 pages but with a small backend
 
@DaveRandom yeah , got this thing .. was worth it
/me likes good teas
 
oh wait, forget my message above, i just got it...
 
@DarkAshelin Honestly, I throw SSL on everything by default. And if the backend requires a login, you should DEFINITELY have SSL.
 
7:37 AM
hi...
 
Good morning
 
hello guys
 
@Starsong I never worked with SSL tbh :X
 
If the baker logs on his backend in McDonalds or Starbucks with open wifi, anyone can steal his password if you dont use SSL
 
0
Q: SQL SUM result always show double data

user2806837I using TOAD for my ORACLE query, now I have question, why the result of query always show 2 whereas I have grouped my column. To make a clear, here it's my code : SELECT DISTINCT M.MODEL_NO, P.FORM_NO, P.MODEL_NO, P.DATE_ADDED, Q.FORM_NO, Q.STATUS_QTY, SUM(Q.QTY) OVER (PARTITION BY M.MODEL_NO ...

 
7:38 AM
@Starsong but who would care to "hack" into his site and change some text?
 
Guys, I need your help... If possible please help to answer...
 
@DarkAshelin When I was at uni I used to catch people who weren't using HTTPS facebook by stealing their sessions and then showing them their FB logged in on my PC. Not to be malicious, just to show the risks.
 
@Starsong how do u steal their session in the first place? O.o
 
7:39 AM
@DarkAshelin There are 1000 tutorials on Google for how to steal a Facebook session
 
@DarkAshelin session is tied to PHPSESSID cookie
 
@tereško Interesting. If have £81 to spare I would consider that, what's your impression of the build quality? In my experience kettles are kind of throwaway items, if I'm going to spend £80 on one I'd want to get a good few years usage out of it...
 
@DarkAshelin I just used Firesheep tbh. I'm too lazy to work it out.
 
@DaveRandom well, bought it more then half a year ago .. still works just like new
 
7:41 AM
and if you buy something over 50$, you usually hang on to the recite for warranty anyway
 
@Starsong ty, reading it
 
s/recite/receipt
 
@tereško Yeh I admit (and it's the same with toasters) I usually buy like the 3rd cheapest, which will have more of a throwaway quality to it. Electric heating elements are just so breakable and non-user-serviceable though, I like things I can fix (not that there's anything that can be done about this in teh context of a kettle).
 
0
Q: Getting some error while opening excel that is generated using PHP

Amit SinglaI am getting the below error while openning the excel generated using PHP code: "Excel cannot be open file "test.xls" becouse the file format or file extebnsion is not valid,verify that the file has not been corupted" And here is the error log for above: <?xml version="1.0" encoding="UTF-8" sta...

please help me
 
7:47 AM
Upgrade Excel.
 
anyone having ie9?
 
you can emulate it on IE10/IE11preview
 
@tereško I did used dev tools, but this noob is not understanding
 
Hey friends
i'm freshmen in php
 
my condolences
 
7:53 AM
@DaveRandom random returned 88 ^^^
 
und today i code a form action
but it doesn't workd
 
@Mr.Alien Ummm... pardon?
 
well ... E_DOESNT_WORK is not a proper error code
 
this is a little example
i have error
if you testing
 
7:54 AM
@DaveRandom -> @Dave-88 @tereško sigh, some are so stubborn to verify
 
@tereško What about E_DOESNT_WORKD?
 
i don't get request
in my actio url
 
@Dave-88 try adding var_dump($_POST) in the ausgabe.php file
 
okay i'm testing
 
@Dave-88 Code for ausgabe.php on pastebin please?
 
7:56 AM
eih
 
array(0) { }
Notice: Undefined index: name in /opt/labscope/htmlapp/ausgabe.php on line 11

Notice: Undefined index: nachname in /opt/labscope/htmlapp/ausgabe.php on line 12

Notice: Undefined index: eingabe in /opt/labscope/htmlapp/ausgabe.php on line 14
Bitte verwenden Sie das Formular!
 
@DaveRandom here my code in the ausgabe.php
<?php

    var_dump($_POST);
    $name = $_POST["name"];
    $nachname = $_POST["nachname"];

    if($_POST["eingabe"] == 1){
        echo ("Name $name und Nachname $nachname");
    } else{
        echo("Bitte verwenden Sie das Formular!");
    }

?>
it's simple but i don't why i get no request :(
know
 
I see the issue
u didn't check on isset($_POST["name"])
 
@DarkAshelin that's not the important part. It looks like the $_POST is empty
 
That actually is a bit weird
 
7:58 AM
yeah
 
@Dave-88 off-topic, but use <label>Name:</label> instead of plain text
 
Is it possible to disable $_POST population in php.ini?
 
you're not using AJAX or anything are u?
 
@DaveRandom Yep, just remove it from variables_order afaik.
 
@Dave-88 try var_dump( $_SERVER ); instead
seems like something is wrong with your setup and not your code
 
8:01 AM
Also var_dump(ini_get('variables_order')); as well
 
@tereško done
@DaveRandom i try it
 
post ur results lol
 
@DarkAshelin Submit the form again
There's no HTTP_CONTENT_LENGTH, which is suspicious
Oh wait it's unprefixed
GPCS variables order, so it should be being populated
@Dave-88 var_dump(stream_get_contents(fopen('php://input', 'r')));
 
so my code is right but the server don't habe HTTP_CONTENT_LENGTH and this is important for post ?
 
good morings
 
8:06 AM
@DaveRandom done
 
That is bizarre. It must be an ini setting, all the data is there it's just not being loaded into the superglobal
@Dave-88 There's nothing fundamentally wrong with your code, what you wrote should work as you were expecting, it's something about your server. Are you on a shared host or...? You may need to contact the sysadmin
 
@Dave-88 did you do something when setting up the environment ?
 
Can anyone explain why in first case at gist.github.com/nikic/6699370#cv-optimization it's 3 not 4?
 
<?php phpinfo(); ?> ... can you show us result of this , @Dave-88
 
^^ that
 
8:10 AM
see the profile views
 
$tmp_1 = ADD      $a, $a // $tmp_2 = $a + $a; (1 + 1)
$tmp_2 = POST_INC $a // $tmp_2 = $a; $a = 2;
$tmp_3 = ADD      $tmp_1, $tmp_2 // $tmp_3 = $tmp_1 + $tmp_2; (2 + 1)
@zerkms
 
$tmp_2 = POST_INC $a - oh right
I assigned 2 instead
 
If you pre-inc it would be 4
 
yep, makes sense
 
I'm stumped
@Dave-88 , did you set up the server yourself, or is it some sort of shared hosting ?
 
8:15 AM
hey friends
i get a tipp
$_POST = $post;
but this is no beautiful :)
 
@DaveRandom It's best avoided, that :)
 
wait WAT ?!?
 
@Dave-88 That doesn't do anything apart from probably break things
 
@Dave-88 are you saying that all the values from form are in the $post variable ?!
 
$post = array();
    parse_str($inputString, $post);

    $_POST = $post;
 
8:17 AM
But actually that is a good candidate for the root cause, reassigning superglobals you're gonna have a bad time
 
Oh my.
 
@Dave-88 you've got some pretty bad info
 
that's not the solution
2 mins ago, by tereško
@Dave-88 , did you set up the server yourself, or is it some sort of shared hosting ?
 
@Dave-88 How are you getting $inputString?
 
@Dave-88 You could just parse_str($inputString, $_POST); but what you actually need to do is find out why it's not working the first place
 
8:18 AM
First of all, globals like $_POST are NOT meant to be written to.
 
@tereško a server administrator set up the server
 
then he/she has done something wrong
 
My fingers think it's opposite day.
 
Personally I smell a badly configured suhosin
Or... what happens if you set max_input_vars to 0 I wonder...?
 
@DaveRandom i think the same
 
8:20 AM
@Dave-88 , what do you see when you do var_dump( $GLOBALS ); ?
 
all the global variables
duh
 
@tereško done
 
@ircmaxell go get some coffee
yeah , looks like something is cleaning out the $_POST array
 
Now that's security for you!
 
call your sysadmin, @Dave-88 , it's his fault
 
8:24 AM
@tereško thx you for this info
 
@tereško yeah
 
and thx for all friends here for the help
 
@DaveRandom Doesn't this remind you of something?
 
@Jack Yes it does. I reminds me of a rare useful function in a terrible and rarely available PECL extension.
 
@Wes apparently some religious nut who didn't like getting a mod message.
 
user652649
8:34 AM
lol super funny
 
user652649
morning all
 
@DaveRandom I kinda like the extension though ... it can do some pretty powerful stuff.
But I would agree that it's availability is scarce at best.
 
My VPSs have been down for over 8hrs "...currently experiencing an interruption due to a faulted storage node cluster. The faulted storage node cluster is 75% recovered"... such a nice round (made up?) number, and I wouldn't call 8hrs an interruption, I would call it a disaster. I'm going to begin the migration process over to tereško's VPS provider as soon as I can access my data. =o( what a crappy day
 
Also, I hate the signature.
 
@crypticツ that sucks ...
morning all ...
 
8:36 AM
morning
 
who is the provider ?
 
@crypticツ Did you consider Heroku?
 
Morning
 
@Jack no, let me check them out
 
@Jack It's full of things that are a) assume you are using it in a web sapi and b) are coupled to the current request context (for ex. the negotiate_* functions don't accept an accept spec arg). In a nutshell, it's not generic enough.
 
8:39 AM
How'd it go? @DaveRandom :)
 
@crypticツ I cannot promise you that mine will be better. I have used it only 2 month. Maybe they have huge blackouts when I sleep.
 
@Fabien I sent it over last night, not had a response yet. I'll let you know. I'll find somewhere to put it where you can have a look at it later on.
 
@DaveRandom I haven't looked at it in much detail tbh; I was looking at it because I felt the need to upload something while downloading it from somewhere else :)
 
@tereško lol, well then I shall hold on for a few days and do some more looking =oP
 
@DaveRandom Coolio. You were satisfied with it?
 
8:40 AM
@Jack stream_copy_to_stream() should be all you need for that
@Fabien Not really, but is anyone ever?
 
@DaveRandom lol very true :)
I'm sure you've smashed it out the park though
 
@DaveRandom Yeah, with a base64 filter in between that should work ... it's just not very easy :)
 
@Jack looks pricey =o(
 
What's considered pricey to you?
 
@Jack Vote it with passion :D
 
8:42 AM
I have only looked at their free tier.
 
@Jack Why is that necessary? Can't you just fudge the transport headers around?
 
@hakre So many .sort() questions lol
@DaveRandom You could do binary transfer encoding, sure, but you're left with writing the multipart headers yourself.
 
@Jack I have found Heroku to suck somewhat performance-wise tbh
 
And again, even if mildly trivial to a routined h4x0r, it's far from simple.
@DaveRandom I've never used them ... my hosting option is always attacked by those without money =(
 
I disagree, tbh. Writing MIME is piss easy. Decoding it without slurping system resources is the hard part.
dunno what happened there
@Jack You get what you pay for.
 
8:46 AM
@Jack well compared to Tilaa and my current provider its $9-18 per 1GB 1x2.4Ghz VPS, I need 3. So right now I'm willing to go up to ~$50/month for total of all 3, which I can pull off with either of them. Heroku from what I see is $35 for each VPS, unless I am reading it wrong.
 
Sure, it's nothing complicated. But nothing like ->post(array('file' => $f, 'data' => 'xyz')); :)
 
@crypticツ You need 3? wtf are you doing??
 
^^ THat
 
@DaveRandom one is for database, one if for webserver, and other is misc for whatever I feel like doing and don't want to break anything =oP
 
@crypticツ How much traffic do you get? tbh my view on that is: probably your db and live server can be merged into one, sandbox can be done on a local VM.
 
8:49 AM
@Jack pricey is anything that doesn't give me money while I'm NOT working on it
 
Really you're only going to need another server when you start hitting (at least) hundreds of requests per second
 
@Ocramius That seems like a completely unreasonable expectation, unless you're kidding :)
 
@Jack not kidding. Time is money.
 
8:50 AM
Two brothers were asked by their other brother to be the best men at his wedding, and they made this video instead. lol
 
@Ocramius How would anything give you money for not using it?
 
@Jack by having a customer pay more than what it costs
 
@DaveRandom I host way too many porn sites to merge the servers =oP
@DaveRandom isn't it better for security to separate them?
 
@Ocramius There you go, that's all you need :)
 
@crypticツ only for sensitive data
 
8:52 AM
@crypticツ You should consider what would happen if they break into your web server.
 
@crypticツ Maybe, maybe not. Depends whether you actually need that level of security, anyway.
 
Finding the site configuration and logging into your database is a piece of cake ... though, of course, they wouldn't get full privileges unless they hack into that as well.
But the data acquisition alone is bad enough.
 
Well if web server gets hacked and they say have access to delete files say at root level, won't they be able to delete all my databases since it's on same filesystem? Opposed to them only getting access to the limited database user in the credentials stored on webserver?
 
@crypticツ it's easier to do backups. And if you really consider that data so valuable that it is a problem if it's gone, then I'd maybe start thinking on why it is not paying for itself :)
 
8:55 AM
right now I have databases with different users with limited access, which access via SSL from the web app to minimize damage in case web app is hacked. That way they are limited to that specific database.
 
@crypticツ Disaster recovery is a different aspect :)
 
also having the web and database separate allows me to have redundancy by having multiple databases on different VPSs as failover, same with the webserver.
 
It's fairly easy to scale out when necessary.
 
Ok, so um get two VPSs then? One for web/db and other for just messing around with?
 

« first day (1076 days earlier)      last day (3871 days later) »