« first day (1690 days earlier)      last day (3274 days later) » 

2:00 PM
@ircmaxell yep, DIC should never be a dependency. I look at it more as a configuration file which tells the library/project what to use when instantiated
 
@VeeeneX etag
 
What about last modified ?
 
@VeeeneX sorry I misunderstood your question
@VeeeneX what does captcha.php do? Generates an image or it chooses from already existing images?
 
@FlorianMargaine Thank you!! ;) @ziGi Don't worry I'm sure I will need some help in future :D
 
posted on June 02, 2015 by kbironneau

/* by klamping */

 
2:04 PM
@ziGi It generates images "randomly"
   $phrase = $Service->Captcha->getPhrase();
   header("Etag: " + md5($phrase), false);

   $Service->Captcha->build();
   $Service->Session->set("captcha", $phrase);
Looks fine ^_^
 
how are you going to use the etag on the front-end?
 
@VeeeneX "Etag: " + md5($phrase)?
this is spharpa, not jabbascript
 
This the output of this htmlentities("<I>\"") put in a textarea results in this <I>&quot; Question : Why only the double quotes where converted and not the <> ??
 
@FlorianMargaine Hmm, I don't have enough experience what's wrong in that code ?
 
@VeeeneX try running it
 
2:10 PM
@Joseph it works: 3v4l.org/nM46o
 
Ahh :D
 
@VeeeneX + is not concat
 
though don't use htmlentities, and instead use htmlspecialchars
 
Yeap, PHP is using .
 
Isn't there a better header response field than ETag for sending that information
 
2:12 PM
But small problem ETag is not working
 
@VeeeneX on the front-end?
 
ETag is in header but Browser doesn't make another request
Yes, @ziGi
 
@VeeeneX can you clarify a bit? What do you mean by that
 
captcha?0.717727132840082 This works perfectly But I don't trust users
 
fuck
I was way too close to smoke alarm
 
2:14 PM
Blargh, ruined.
 
@ircmaxell echoed in a text area , that's where it doesn't
 
@VeeeneX Isn't your idea to return some kind of digest together with the picture that you can use later when the user submits the form containing the text from the captcha?
 
@ziGi Imagine 2 forms which have Captcha each time I reload page my Captchas are same
 
@Joseph look at the raw generated HTML
 
@VeeeneX I still don't understand, can you explain a little bit more, what you are trying to do, maybe that's not the best decision
 
Any good resources on good design of a user point system. How to award and keep track of awarding points to site members?
 
@VeeeneX from what I see on the picture, there is only a single request made for captcha. Shouldn't you make two requests if you want different captchas on the different forms?
 
heading to the train station, later
 
12
Q: Keeping Track of User Points (Like SO)

BlankasaurusI want to be able to keep track of user points earned on my website. It isn't really like SO but the point system is similar in that I want each user to have a total and then I want to keep track of the transactions that got them to that total. Should I keep a user total in the User table or sh...

 
@ziGi I can't change anything on front-end, each form has img tag with same src
Only this reloads captcha properly
  reloadCaptcha: function()
   {
      $(this).closest(".form").find('.reload-captcha').attr('src', paths.base + 'captcha?'+ Math.random());
   },
 
2:23 PM
@VeeeneX but there is still only one request made for both captchas from what I see on the picture, meaning that only a single one is generated. Are you sure that reloadCaptcha shouldn't make a request to the src to get a different captcha?
 
@ziGi reloadCaptcha is loading different captcha which is good because it makes request which are diffrent so problem is in that one request, because there should be 2
 
@VeeeneX you want to return 2 different pictures in one request?
 
Yes
In 2 requests
But 1 page reload
 
So why is then a single request made and the picture is the same if 2 requests should be made as you are stating?
 
I think I need to tell browser that content has been changed
 
2:32 PM
@VeeeneX the problem is that when you have a few <img> tags with the same src, only a single request is made
try running it a few times
 
Yes, I need to tell browser that content has been changed?
 
so it should be something like that: http://jsfiddle.net/d572pc8g/1/
where there is a different id
so the browser makes 2 requests
 
But as I said what if user removes id?
 
@VeeeneX if you are scared that the user will remove the id of the image after it's being loaded?
 
User can make request without id after page is loaded
 
2:37 PM
Then you use the generated ETag from the image so the first captcha has ETag1 and the second captcha has ETag2, when you do press Form 1 Submit, you send the text and the ETag of the image as a POST request, when the user presses Form 2 Submit you send the second text and ETag2 via POST
 
hello community can i ask here for help?
 
@VeeeneX then you check on the backend if the ETag that was genarated is still valid for the captcha ID
 
@ziGi Ok Thanks for help
 
please someone answer me =/ i need help
 
@VeeeneX do you understand?
 
2:41 PM
@ziGi Ehm, I will fight with it later :D
But thanks for your time
 
Sure, I hope I have been of help.
 
ziGi can you help me ?
 
@DTDest depends what your question is
 
@ziGi i asked on stack overflow but no answer stackoverflow.com/questions/30595370/… this is my question please give a look and if you can support me, thanks
'you down voted me? =/
 
Your question is not good because there is no explanation what is happening
 
2:50 PM
my checksum function is not correct and i can't understand how checksum works
i want someone who will explain better how 16 but checksum works
for example i have 0x68,0x00,0x32,0x16 this kind of hex values i must calculate checksum
and my question is how? how 16 bit checksum works what i must calculate or how?
 
edit your question
also add proper identation to the code
 
@NikiC Ah, see I was running it on 5.5. I didn't know that so much changed with finally blocks in 5.6.
 
3:24 PM
Sigh… we are really bad about referring to string literals as char * instead of const char *.
 
3:57 PM
can some one give me one case where we should use htmlentities instead of htmlspecialchars please ?
 
this is kinda annoying
books shouldn't end on a cliffhanger
 
@samaYo unless you are willing to show your code, I am not entirely sure what you else to suggest. And, to be honest, selectbox replacement, while obviously simple, is not a trivial widget. Especially if you make it reusable and actually linked to the underlaying <select> element. I personally find the addition of keyboard-behaviour as one od the most tricky in that.
 
Anonymous
4:15 PM
seems fair.
 
Anonymous
@tereško is the js code only enough for you or you want to see the whole effect?
 
@tereško select box replacement is simpler than you think :P i made this in the past jsfiddle.net/mv3jnLox it's not not even close to be complete clearly, but it's almost css only. even keyboard navigation works, since it uses type="radio"s that already have that by default
 
@Worf that is not a selectbox replacement
it is not based on a <select> tag even
 
My script is this: 'app-odnk.com/test.php'
why you upload three images is loaded to infinity
 
lol @tereško are you serious?
 
4:18 PM
yes, I am serious
 
what is a selectbox in your opinion then? :P
 
Anonymous
 
@Worf did you try googling it ?
 
Anonymous
@Worf imho select2.github.io
 
4:20 PM
@tereško i altavista-d it, when i first used a selectbox
@samaYo how is that any different from mine?
it's just styled differently
 
ya know what, I really don't want to try to convince you
 
@tereško try
 
I was trying to read a book ..
 
have a look at "chosen"
 
first concept that you have to understand in "progressive enhancement"
 
4:28 PM
it requires jquery though..
anyway even my banks e-banking uses it for <select>
 
@MarcelBurkhard it's for @samaYo. He is looking for "tasks" to guide his JS studies.
 
@tereško first concept that you have to understand is that i made that fiddle in 10 minutes and i used the transformed markup directly
 
as I said
 
@samaYo anyway, don't listen to him, select2 uses the same method i use in that jsfiddle, it's only styled differently. feel free to use that as reference if you planning doing that and ping me if you want some tips
 
7 mins ago, by tereško
ya know what, I really don't want to try to convince you
 
4:31 PM
@samaYo I started looking into Flux+ReactJs yesterday... with npm as build tool and browserify etc. ... little complicated thought, might take me a while to grasp that
 
with @tereško you always end up being the clueless noob is it, no matter how many years of experience you have :P
 
in my opinion the "select box" must be based on a <select> and update if something changes. thas about it
thats*
 
@MarcelBurkhard he was asking for intermediate level tasks
 
ah nothing like when atom crashes..
 
yeah... I just got here ^^
 
4:34 PM
@RonniSkansing i'm pretty sure when an atom crashes you get a bomb
 
also, @MarcelBurkhard, adding keyboard support for it is a bitch
 
god
 
Anonymous
@tereško Is it ok if I share a zip? jsfiddle is not helping with the images and such. Just 6 images, html and one js.
 
@tereško and you should disable it on mobile devices because they have superior default select boxes
 
Anonymous
4:36 PM
@MarcelBurkhard I am way behind. I'm aiming to grasp solid grounds before moving on to frameworks.
 
@samaYo sure, though I was interested in just the JS part of it
 
@samaYo oh well ... you made some prototype based stuff yet?
 
@samaYo like oop in javascript
 
Anonymous
@tereško I know but the html dances around during the lightbox action link it need some comments.
 
Anonymous
4:38 PM
@MarcelBurkhard I'm a JS newbie :)
 
Hi all
Somebody please help me
 
@samaYo that site is blocked by my antivirus (nod32)
 
0
Q: How to send the push notification only to iPhone device in following scenario?

user2839497I'm using gomoob:php-pushwoosh a PHP Library that easily work with the pushwoosh REST Web Services. I want to send push-notification only to iPhone device. Following is the sample program I've written to send a push notification. Can someone please correct my code in order to send the push noti...

 
Anonymous
@tereško Is there any file sharing site that your antivirus hasn't blocked?
 
ain't you using github already ?
or just dump the JS part in a pastebin
 
Anonymous
4:40 PM
@tereško this is not a github worthy. Anyway, here is the js pastebin.com/WVqx8TjF
 
    var container = doc.querySelector(".image-container"); you should be injecting element references, rather than selecting them internally
if(window.addEventListener){ // no. :P
 
Anonymous
@tereško github.com/forkosis/lightbox cc/@Worf
 
it's not reusable, it's procedural code
i would improve that rather than try creating new stuff
 
Anonymous
Yeah, I need to prototype moarr .. but this is just a sketch, not a demonstration for anything. I just want to know which areas to improve
 
hmm .. 1. dont use JS to apply CSS, unless you are doing some complicated animations, 2. this pollutes DOM (I think) the longer you use it
e.target.getAttribute("data-big-image"); .. emm, no : developer.mozilla.org/en-US/docs/Web/API/HTMLElement/dataset
 
4:49 PM
firstly you could start separating into components, like
- frame
     - window
          - modal
     - modalFrame
 
that too
 
Anonymous
@tereško Ok, but how would I handle for example, .. the display:none stuff. If I can't inject css directly to js?
 
and you probably would get better results if you reused the modal window, instead of creating new one every tim
 
Anonymous
@Worf Example?
 
Anonymous
What's a modal window?
 
4:51 PM
@samaYo in general, you should change the presentation of the elements by adding and removing classes
@samaYo "fake popup"
 
like confirm() or prompt() @samaYo windows that ask you for something in order to continue execution
 
Anonymous
How the fuck did I not think about that? Yeah, I should've used the popup, I spend an hour wandering what made the image pop :)
 
close = doc.querySelector(".close-window"); : you created that exact element just few lines above. Do not select if anew. Instead reuse the existing variable.
 
Anonymous
@tereško +1 for the class injection. I actually had done it paragraph.setAttribute("class", "close-window"); but failed to do it again for the other doms.
 
H S
Hi all, I am trying to build a restful server which will send only JSON data and the client side will parse it and display it. But if I want that only my site should be able to connect to api, what mechanism should I consider?
 
4:56 PM
@samaYo paragraph.className = 'close-window';
 
H S
Is restricting cross site scripting enough?
 
@HS Authentication
 
@NikiC I'm looking at fixing some const char * issues and I'm down to some things I think are genuine errors (not laziness). I think add_assoc_string's param str *should` be char * since zend_string needs to be able to write to the string contents, correct?
 
Anonymous
@tereško Yeah, I forgot className was there for a reason :/
 
I'm asking because ext/date is passing some const char * to those in some cases. I think they need to be doing a strdup before handing the string off to add_assoc_string.
 
H S
4:58 PM
@PeeHaa client will make ajax get and post request to php server and get data. What Authentication can I put in between?
I had asked a question about it in programmers. stackexchange, But didnt get full information
 
Anonymous
One question. What is this called (function (arg, arg){ .. i.e. passing arguments to into the function scope. could I pass document or anything that is useful to the script like that? I really don't know how that works. @tereško
 
H S
0
Q: Separating front end and back end using private api php

H SI am using php only for basic CRUD operations with MySQL. I want to create private API in php. From what I came to know , these are the steps for a developer local server to get data from remote server using private api : Let the developer create a developer ID and one application ID beforehan...

 
Anonymous
@PeeHaa along with HTML and CSS would you say JS is the next most important language to learn in conjunction with PHP?
 
@samaYo you don't need to pass stuff into closures in js since everything that is in the outer scope is also visible in the inner one
console.log(document === (function(){ return document; })());
 
Anonymous
@Worf hmm, I saw those in some fancy looking js libraries, always wandered the purpose of it.
 
5:02 PM
but actually, you could argument the document if you want to support iframes
var x = new Lightbox(document.querySelector("iframe#1").contentWindow.document, ...);
 
@samaYo this might help: youtu.be/…
 
Anonymous
thanks.
 
@Ja͢ck I never asked the guy for the actual details (I didn't want to know) but I heard a story from a guy once, where someone had added some monkey patching to a class which stopped the debugger from working. And so they hadn't been able to use a debugger on their project for 6 months. Which is the point at which I walked away before I got infected...
 
Anonymous
27 mins ago, by Worf
if(window.addEventListener){ // no. :P
 
Anonymous
@Worf Just curious, how would you register/detect an event using OOP?
 
5:11 PM
@NikiC Ah, add_assoc_string_ex ends up copying it with no modifications prior so it too should be const char *.
 
i meant it's pointless checking if addEventListener is supported, you use standard dom or you use jquery. it's not your library's task checking if things are supported by the interpreter
 
@LeviMorrison yes+
 
We are so bad about respecting const char * on string literals >.<
 
Quick question room: Currently I have validation in my setters, but what is the typical approach when I need validation across, let's say 2 properties (2 setters). For example, a stateId can't be blank if a cityId is filled. But what if the user wants to set the cityId first, then immediately afterwards set the stateId?
 
Add a setter that accepts both?
 
5:16 PM
Yeah, this is what I'm thinking....
 
as in, setCityAndState($city, $state)
that way the remaining others can contain their local validation
 
Yeah....but would it be wrong to force the user to set stateId first? Or is that bad practice?
 
@DavidGraham Depends if it's a library code or you're talking about a user interface.
 
If you're validating that a city is within a state, if you change the city to an out-of-state city, the city validation should complain.
 
meaning, I'll throw an error if they set cityId first before stateId (assuming the object doesn't already have an existing stateId)
 
5:17 PM
But if you change the whole state, shouldn't that immediately invalidate the city to begin with?
The two are directly linked. It'll only make sense to change them together.
 
@HS Why don't you render your stuff on the server instead?
@Jay Subjective question is subjective
 
@Charles what would be a refactoring approach if at first I had 2 setters (cityId and stateId), but then later needed to update my validation (to involve the 2 together)?
I guess what I'm concerned about is....why wouldn't I just have a single "set" method and pass in an array
 
Well, let's zoom out a little. Does this class deal with whole addresses, or are the city & state just other things to worry about overall?
 
It's actually a Value Object called Address
I want the VO to be self validating
 
H S
Currenly I do it on server side. PHP server generates the pages and sends to client. But lately I have been amazed by concept of fat client - the way angularJS get JSON data and renders it on browser. It makes the project development so easy
 
5:21 PM
@DavidGraham Do you at any time use an external service to validate the correctness of the address?
 
I don't want to use any "builder" so I have a constructor that looks like this:
public function __construct($line1 = "", $line2 = "",
$cityId = 0, $stateId = 0, $countryId = 0, $zipCode = "")
 
H S
The backend guys can continue making changes, and front end guys can use any framework like material angularJS or polymer
and make display JSON data
 
Anonymous
@PeeHaa indeed, what would be your personal opinion?
 
H S
@PeeHaa
 
@Jay Learn whatever you need to make more money the easiest way.
 
5:23 PM
@Charles I'm of the camp that I prefer to keep validation as a responsibility of the class itself (unless it's validation on a specific operation/context)
 
@DavidGraham So before you get any further, you should go read this article on address formatting. You're probably going to be better off only attempting any sort of validation on an address once you have all of the address information.
 
After I construct the VO, I may want to update the city and/or state
 
That is, for this case, you probably don't want to do on the fly validation of values as they're set.
 
@HS Well in that case. How do you prevent webpages from being downloaded by clients?
 
H S
Now I am using robots.txt
@PeeHaa
 
5:26 PM
Exactly! you don't
 
@Charles thanks for that link. I guess I know my validation is NOT going to be that bulletproof. But there are some things I want to protect against. Having a city without a state is one of them. Whether that city belongs to that state, I may have to validate some other way (usually the UI should not offer up this option, because doing an extra query to confirm this is costly)
 
...
 
Anonymous
@PeeHaa JS it is
 
@Charles I guess the answer is, stick to validation in the setter when possible, but expect to refactor setters together if validation goes across properties (instead of forcing a certain order of "setting" on the user)
 
H S
@PeeHaa I am using .htaccess to prevent some of the user agents
 
5:27 PM
@DavidGraham That'll probably work.
 
H S
from downloading it. l
 
@HS You know user agents can be changed easily, right?
 
H S
Dont have much knowledge about that . But I need to know the solution. Is getting data from server only in json format and displaying it good - production ready - mechanism?
Or else what people do ? What do you guys do when you need to implement these kind of architecture?
 
@HS Yeah, getting JSON from server then formatting that data client-side is a very common approach
 
H S
So @DavidGraham , if I prevent cross site scripting, that would be enough right ?
enough to prevent some other XYZ site to get data from mine
 
5:31 PM
I do this things like messages/errors, datagrids, input (ie. select drop down) cascading, etc.
 
@HS That does nothing
Everybody can use any user agent
 
@HS ... You are worried about someone using your site as like their own API? I see.....
 
You put something on a public website it's public
 
you should be passing a token on requests....
 
It's that simple
 
5:32 PM
well, I'm assuming his own pages are making AJAX requests to get the JSON
he's not just posting JSON on first page load
 
H S
Ya @DavidGraham
 
so a CSRF token will work
put it in the meta
and add in your jQuery $ajax to always pass the token
    $.ajaxSetup({
        headers: {
			'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
        }
    });
Generate a token for every view you have and place it:
 <meta name="csrf-token" content="{{ csrf_token() }}" />
 
H S
ok so this token has to be generated on every page load, and should be valid for certain time duration... am I thinking in right direction?
 
This will block any other guys from trying to steal your JSON and make their own API site. Doesn't block them from Iframing you...(you can block iframing though as well)
Yep you are right on @HS
 
H S
ok thanks a lot @DavidGraham... and @PeeHaa too
 
Anonymous
5:37 PM
@tereško So, should I move on to another project, or improve & OOP-fy this one?
 
You should decrypt the token, the token would perhaps contain the time. You compare the time against your server's current time, if it's too old (like a day) then reject it
That way someone can't just grab a token from "view page source" and start pulling JSON (for more than a day or whatever time frame)
 
@samaYo I assume you finished watching that video .. at least to the point you could still understand it (that series has a similar learning curve to CleanCodeTalks). Anyway. It's kinda hard to decide what you should try doing next.
 
H S
ok @DavidGraham so use cross site scripting - to prevent other ppl from making ajax calls to ur server.... and using csrf will be extra layer of security
 
@samaYo my recommendation would be to do at least one more iteration for the lightbox and then still try to make the selectbox replacement. BUT, it would be really useful if you tried reading either "Eloquent Javascript" or "Javascript: The Good Parts"
you need to get handle on how the "functional programming" aspect of JS works
and I don't think that's something you will be able to "discover" while making these exercises
 
@HS yep. You can also put some signature trail in your data. Put in a few things (perhaps invisible, or perhaps a certain style, like 2 spaces instead of 1, etc.) that if someone decide to try and "screen scrape" your content, you can determine that a site did indeed do that. But that's probably going a little overboard paranoid.
Also, you can look at your server logs. If you see some IP consistently hitting you, there could be something going on there.
 
H S
5:46 PM
oh thanks for info. ur awesome. @DavidGraham
 
Like @PeeHaa said though, checking the header alone won't work. So yeah, CSRF token is the way to go.
Your welcome. :-)
 
@DavidGraham That doesn't prevent anything
 
@PeeHaa ??? CSRF token is industry standard way to guard it
 
I just have to make an extra request to get the csrf token
 
@samaYo study-by-iteration and only bring you so far. Basically there is a threshold, that one can reach on his/her own. But then you need a kick-up-your-ass to break through that threshold. Those books should provide the kick. Then you can improve on your own by solving the problems.
 
5:47 PM
Sure, you can curl and screen scrap the page to get the token, then make a quick additional request to get the JSON (plus spoof the header)
 
@DavidGraham Nope sorry :)
CSRF is to prevent people from making requests on behalf of other people
It's not in place to prevent access to public information
 
@PeeHaa including yourself
you don't want someone making requests pretending to be yourself
 
Including myself what? :)
 
hence, the CSRF "token", key word token here
 
Doesn't OP want to prevent 3rd parties to access his public api?
How does you token prevent that?
 
5:49 PM
You don't want to serve anyone JSON (it's easy for someone to use in their own site)....you want them to be forced to screen scrape if they are going to steal
 
So it doesn not prevent it
 
Well, that kind of talk is not really perceptive and helpful, LOL
 
CSRF is used for example to prevent me sending you a link or whatever which does some action on your behalf
 
@HS is talking about how to protect stuff in a public context
 
And a csrf token does nothing to prevent that
 
5:51 PM
It does a lot
Don't take my word for it
 
No it does nothing
 
Look at any PHP framework
 
Anonymous
@tereško yeah, I guess you're right. I'll finish watching the video and read one of those JS books, and see where that takes me. I will then evaluate the lightbox after 2-3 weeks.
 
I can look all I want, but csrf cannot prevent that
 
@samaYo two long
try "on the weekend"
 
5:53 PM
I guess Laravel just wants to waste your time there?
 
No it does not. It just doesn't prevent what you think it prevents
 
H S
shiflett.org/articles/cross-site-request-forgeries . here the author tells to use csrf token , make it applicable for 5 mins or so .... so @DavidGraham is right .
 
@DavidGraham Actually laravel does, but that is not related to csrf protection
 
H S
what do u think @PeeHaa ?
 
@HS Useless for your use case. So unless I don't understand what you are trying to do it is useless
 
5:54 PM
@PeeHaa maybe you are arguing semantics, but even then I don't know what you are arguing?
 
H S
@PeeHaa - I will explain u by example
Say i want to display all the list of items in my webpage in index page. What I normally do is - I query the server in index.php file, echo it out in page, and serve it. But what I intend to make a index.html page, make ajax call to api.php using jquery or angularJS, then get the data and render it
So I was thinking that if I can make ajax call and get data, why cant other site do it? So I wanted to know how to prevent it
 
Yes. How do you prevent access to the index.php under normal circumstances
 
@HS or more practical, you render it as HTML on first page load, and all subsequent requests are made via Ajax, so you serve the data via JSON for that. You are trying to protect the JSON as much as you can.
 
God. This is becoming stupid @DavidGraham
1 min ago, by PeeHaa
Yes. How do you prevent access to the index.php under normal circumstances
Answer that please ^
 
Ummm... nobody said he didn't want anyone accessing index.php?
 

« first day (1690 days earlier)      last day (3274 days later) »