« first day (2054 days earlier)      last day (2890 days later) » 

7:00 PM
So if you are going to republish user supplied data, yes that would mean you "use" it
 
user986408
for example their /tags
 
user986408
actually the only things i would need is the user's reputation after oauth login and maybe the tags
 
I would yes that tags are also user generated, so you technically probably should add attribution. IANAL though. You might want to open a meta question with your specific question
 
user986408
good idea
 
Anonymous
Jellow
 
Anonymous
7:04 PM
!!wotd
 
mugwump: a person who is unable to make up his or her mind on an issue, especially in politics.
 
Anonymous
Like Hilary Clinton
 
Ekn
evenings
 
user986408
@PeeHaa may i ask where you placed your attribution?
 
user986408
(back when you used the api)
 
7:08 PM
o/
 
user986408
./
 
Anyone else think sites like Facebook are glorified forums?
 
lol
glorified forum??
Sorry not really imo
 
You can turn a forum into a 'social site' quite easily though, so why not?
 
It's a photo tagging app
 
7:10 PM
@codepushr I didn't. I just used the data for a chat-plugin. Which meant I directly linked to the content
@Ekn mornign
 
rewrite /([a-z0-9]+)([\?[a-zA-Z0-9\+\-\_\&]+]?) /$1.php$2;

rewrite /api/([a-z]+[-[a-z]+]*)/\??(.*) /api.php?module=$1&$2;
rewrite /r/([a-z0-9]+[-[a-z0-9]+]*) /read.php?post=$1;
 
user986408
@PeeHaa ahh. i see, i just wonder if it's sufficient to put a reference on the imprint/legal page or if i have to place it into my footer on every page :I
 
the url /api/search/?q=string does not work, why?
without the first rule, they work fine
 
AFAIK (but again ianal) you need to add the author(s) of the content and a link to the original content
 
7:13 PM
@Victor This is what we all use in our applications:
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . index.php [L]
Or actually many will be using nginx instead
 
those rules are for nginx
 
Ow sorry didn't actually read it :P Just noticed odd looking rules :-)
 
but that has nothing to do with my problem. your thing only rewrites the page/ as page/index.php doesn't it?
@PeeHaa :))
 
@Victor you should do the actual routing in PHP and not in webserver's config
 
@Ekn Haha that's awesome and ridiculous at the same time.
 
Ekn
7:14 PM
exactly my thoughts
 
In nginx it's mostly just try_files magic @Victor
basically what @tereško said
 
hello php room
 
@tereško my website is not build like that
it would mean changine the whole thing
I guess
 
I have created a uploading script can sm is able to check if is secure to upload images ? Please have a look paste.ofcode.org/gLNQND3BCmZnRfQ8ymsAA6
 
@Victor What is that $n stuff?
Does that work in nginx?
 
7:20 PM
regex capturing?
works with anything
 
But does it work with querystringparams?
SHouldn't you do $arg_name instead?
 
anything. it's just a string after all
 
What is tht
 
@Victor yes but it is really part of the string?
 
yeah. the query string is part of the url. it's not like the hash
 
7:23 PM
yes I know that, but does nginx rewrite rules agree?
2 mins ago, by PeeHaa
SHouldn't you do $arg_name instead?
tbh I never have to do stuff like that, because I am sane :P But I have seen people do that
 
much sane
 
what is this @Phoenix
 
7:26 PM
@Phoenix The amount of indentation makes me not want to review that
 
@PeeHaa it works yeah
 
it is well identated
I dont prefer like this
for(;;;)
{
}
 
i didn't read up but you can use rewrite rules in nginx
 
@AdilIlhan :P
@Victor @AdilIlhan volunteers to help you :)
 
7:27 PM
;-)
 
@Phoenix I think you are lacking csrf
 
I think I will go for fastroute
 
and some headers
 
@PeeHaa o.O
 
for php
I hope it's compatible with hhvm
 
7:28 PM
Seriously I don't know nearly enough about nginx rewrites to say anything helpful besides what I already suggested multiple times
 
@RonniSkansing how is possible in this script csrf ?
 
you are scaring me @PeeHaa
:D
 
omg it actually is
they have .hhconfig in their repo
 
what's wrong?
 
@Phoenix do you know what CSRF is?
 
7:29 PM
@Phoenix No, having 10 levels deep nested is not "well indented" :P
 
yes
 
so you can see that you are not protecting against this?
 
18 mins ago, by Victor
rewrite /([a-z0-9]+)([\?[a-zA-Z0-9\+\-\_\&]+]?) /$1.php$2;

rewrite /api/([a-z]+[-[a-z]+]*)/\??(.*) /api.php?module=$1&$2;
rewrite /r/([a-z0-9]+[-[a-z0-9]+]*) /read.php?post=$1;
 
and a attacker can make a victim upload files without the intent of doing it
 
user image
3
i remembered this when i saw paste.ofcode.org/gLNQND3BCmZnRfQ8ymsAA6
 
7:30 PM
that's horrible
 
Ekn
there was also "horse head driven development" pbs.twimg.com/media/BrdPeaECUAE_B4f.png
 
@Phoenix also this regex (\\/?%*' :|\"<>)
or sorry its not a regex
 
this i use for validate name
of image
 
Ekn
:D
 
7:34 PM
So it mat not contain any of those chars @Phoenix ?
 
Yes.. it does not
 
Anonymous
@tereško context?
 
then again, mine version was closer to "russian-investor driven developmen"
 
@Phoenix I am not sure that is sufficent
&lt; &gt;
 
I tested these script with different name and different type of file.. it works.. but i dont if it is sufficent or not
 
7:36 PM
okay, what are you going to use the script for?
 
i can insert this &char in script
 
guys, i don't understand the matter. but why you don't use a "secure" upload class?
 
does not meet requirements lol
 
requirements?
 
Anonymous
!!google php secure image upload github
 
7:37 PM
@RonniSkansing "\\/?%*'&; :|\"<>" is it enogh ?
 
Search for "php secure image upload github" (https://www.google.com/search?q=php+secure+image+upload+github&lr=lang_en)
• GitHub - DhavalKapil/image-uploader: A simple and… - The aim of this project is to provide users with a simple interface to upload images in their appli… (https://github.com/DhavalKapil/image-uploader)
• GitHub - samayo/bulletproof: PHP secure Image upl… - PHP secure Image uploader, with a nice API. Contribute to bulletproof development by creating an a… (https://github.com/samayo/bulletproof)
 
@Phoenix dont think so, the chars that needs to be escaped or converted is upon output context
 
but i am using also md5() and change name of file
 
Can I ask someone opinion on something?
 
guys this code's point of cyclomatic complexity high
also it's not secure
you have to apply a lot of security checks in this code
 
7:41 PM
@Tarson sure
 
@NikiC Misappropriate goto into optimized cases sucks :x … Thanks a lot for reviewing :-)
 
also i were you, you would add an image process to this code
 
Anonymous
@Tarson if u want secure image uploaded use bulletproof
 
ehehe i guess @Tarson will ask about another question
 
Bulletproof usually means not that secure
 
Anonymous
7:45 PM
Yes "usually".
 
Anonymous
@AdilIlhan that was meant for you btw
 
Anonymous
@DejanMarjanovic webarto?
 
heh, wrong person. @Phoenix wants write an upload class
 
my own lol,
 
7:49 PM
@samayo
so if the filename is /../../ would directory traversel be possible?
in your bulletproof repo
atm only seeing filter_var($str, FILTER_SANITIZE_STRING as buildin protection
 
@AdilIlhan So true :)
 
@samayo also if you use getName on a image with no name set, twice, you get two different filename for the same resource
 
Anonymous
@RonniSkansing Short answer is no, Long answer is also no. First only valid images types are upload-able, even if you get away with uploading a malicious file how would you name it with slashes to begin with?
 
@samayo Is this a challenge?
 
Anonymous
For 2nd question, no the name is stored in a class property.
 
Anonymous
7:56 PM
@PeeHaa bring it on :)
 
I am just assuming here that I can curl a file over with slashes in it just fine
Not sure
 
@RonniSkansing i upload here script imagetest-sec-securty.c9users.io
 
what is aim? broken to that script?
 
Doesn't something like this work? Content-Disposition: form-data; name="fupload"; filename="1eef2cee-/e10e-11e5-8fc1-ce1df5954553.png" @samayo @RonniSkansing?
 
@samayo I could set the filename via. a proxy
or yea via a curl request
@PeeHaa that looks evil
I have to check out what hell you are invoking with that
 
8:00 PM
bulletproof ?
 
@RonniSkansing Yeah I assume it will just happily accept that filename with the slashes
 
yea I think so =)
 
@samayo ^
 
but anyhow, I will test it in abit
 
Good because I cannot be arsed. Was hoping you would :P
 
8:02 PM
@RonniSkansing did u tried my uploaded script?
 
sorry nope @Phoenix
 
Anonymous
@RonniSkansing I will be waiting ...
 
Anonymous
And praying it does not work
 
@samayo what should'nt work ?
@RonniSkansing when u upload image.. open console ther will result appear
 
reinvent the wheel
 
8:07 PM
ctrlv.in/764149 snapshot of success upload
 
these are problematical characters in EXT4 and EXT3 filesystems: /, NULL, \0
 
which chars ?
 
/, NULL, \0
especially /
the slash is a common problem in NTFS and *nix filesystems
 
Anonymous
Bulletproof has been used by many trusted developers and organizations like IBM, NASA and whitehouse.gov to upload their sensitive, secure and classified data, I doubt if there was an exploit it would go undetected until now
 
sure dude
i want to create for my own lib for using on my site
 
8:10 PM
so that's why, we keep 2 different filenames in db
"real name" and "fake name"
 
in tmp folder ?
 
the real name indicate to name that on disk
blablahash.txt
it is real name
this/is./malicious\0/file/name.txt
this is fake name
the user send a name that named
file
 
$_FILES["zzz"][name] is real name.. $_FILES["zzz"][tmp_name] is like c://xampp/tmp/pphp123.tmp
kiding
 
grrr
:)
 
8:14 PM
wat?
 
@AnmolRaghuvanshiVersion2.0 mornings
 
what is it ?
 
Anonymous
@AdilIlhan there was a bugfix in 5.6 for that issue
 
are you from australia? :) @AnmolRaghuvanshiVersion2.0
 
Austria
 
Anonymous
8:15 PM
Some Ethiopian bounty hunter I can't remember his name ..
 
@samayo i don't remember
 
Anonymous
.. Paulos Yemane
 
can sm1 find bug here ? result come in console.log(); imagetest-sec-securty.c9users.io
 
who is remember famous null byte attack in php? :)
 
Please.. its less proof than bulletproof but still want to know if it is exploitable or not ?
 
8:16 PM
exploitable
 
unsecure
uploaded images: https://imagetest-sec-securty.c9users.io/
 
exploitable, attackable, unsecure
choose any word
 
unsecure
 
:D
ok then unsecure
 
Anonymous
@Phoenix that's not how code review works, You can't ask people to find bugs that way
 
8:19 PM
so how lol ?
 
i gave up
 
wat ?
 
who writes an upload library without security checks in this age?
come on, it is exactly reinvent the wheel
 
Anonymous
@Phoenix gist it or go to code review
 
@samayo i have 0 exp, so i asking for that..
 
Anonymous
8:20 PM
 
they will give me downvote.. i already can ask question on SO. LOL
THEY BLOCK ME
 
Anonymous
Why am I not surprised
 
:O
 
dont waste your time to write an upload class
you can learn design principles instead of write an upload class
 
Anonymous
Codereview is different as the name suggests it is for people to review your code. You will only get feedback on how to improve it.
 
8:24 PM
ok TY @samayo.. then can i ask there ?
 
what we were talking a few minutes... now what we are talking
 
Anonymous
Yes you should, don't ask them to upload to your site and check their console.log()
 
from nginx to code review
 
"I know this site is about coding and developing, but I was hoping someone could help me. I need to know how to build a motherboard." o_O
 
Anonymous
Show your code and explain what can be improved
 
8:25 PM
I want to use a unique identifier with the benefits of a GUID but I want it to be easy to type fast - anyone know of such unique Id? Or how I can modify a version 4 GUID to be easier to type?
 
I have a friend who wrote micro.js.. so i also want to do smthing
 
i wrote a "custom.js" last day
is it coincidence?
oh gosh, maybe we are friend...
 
hey @Phoenix, I need my yard cut and you are looking for something to do. Coincidence?
 
Anonymous
I'm lost. I need a coin for coincidence.
 
0
Q: Php- Upload image with secure Code

PhoenixI have written php code to upload image/s to server . I paste my code in a bin a cause of 100 lines Online Code Working : https://imagetest-sec-securty.c9users.io/ Result shows in : inspect-->network inspect-->console I would like to ask you guys if this code is secure to ...

 
Anonymous
8:35 PM
Closed!
 
Anonymous
@Phoenix I literally told you 10 minutes ago to Show them your code, which you want to get reviews for.
 
Anonymous
11 mins ago, by samayo
Show your code and explain what can be improved
 
sorry i showed them now
 
Anonymous
Your question is now closed because you didn't show any.
 
Anonymous
@Phoenix Can you indent your code? Also don't show your websites address in there or anywhere if you are asking such questions
 
8:39 PM
Has anyone had a chance to think about my GUID question?
 
Anonymous
Nope ;) GUID doesn't scream anything to me
 
website working fine : imagetest-sec-securty.c9users.io
2 mint for indent code;)
 
GOOD NEWS EVERYBODY!
 
16 mins ago, by JustinKaz
I want to use a unique identifier with the benefits of a GUID but I want it to be easy to type fast - anyone know of such unique Id? Or how I can modify a version 4 GUID to be easier to type?
 
(thumb up)
 
8:52 PM
@samayo on the second question. If one calls getName twice without a name set, a new unique string will appear each time.. this is my output from ->getName(); ..->getName(); string(28) "1574df93178e30_opklqfngimjhe" string(28) "1574df93178e72_onfjgklpmqieh"
yea and the setName allows for directory traversel via. filename
ala $image->setName('/../../wow.jpg');
 
Does that mean what I suspected works?
 
if a consumer sets the name manually to a user submitted string, yes.
 
lol
\o/
 
but the lib never uses the filename it always generates a random, unless one uses the setName method
 
So at least not everybody is affected
 
8:57 PM
Noo far from
=)
 
Wes
!!should i a or bdd
 
Dunno.
You should b.
You should bd.
You should a.
 
Wes
oh, it removes the I :B
 
Hello!
 
Been experimenting with it, basically look at the WebAPI\Server class
Will need much work + refactoring but basically I've got an aerys server running on the same loop as the bot and you can get data out of it and call procedures directly in the live server
 
9:11 PM
ohhhhhh
much sexy
 
so we can build a client lib around that and have a shiny web front end
I suck at API design though
at the moment the only routes I have created are /rooms/chat.stackoverflow.com/11 (that's what self::ROOM_IDENTIFIER_EXPR matches)
 
Is there a reason I'm not quite seeing why for statements get compiled as

0: for-stmt-1
1: for-stmt-2 -> ~0
2: jznz ~0, 5, 7
3: for-stmt-3
4: jmp 1
5: for-body
6: jmp 3
7: after-for-body

instead of

0: for-stmt-1
1: for-stmt-2 -> ~0
2: jz ~0, 6
3: for-body
4: for-stmt-3
5: jmp 1
6: after-for-body

??
 
@DaveRandom nice nice. Will have a better look into tomorrow
 
@Dereleased I have no idea…
 
At a guess, the pre-AST compiler had to be pretty much linear, and nobody bothered fixing things up once we got an AST.
 
9:20 PM
Actually, code changed now
I've not immediately realized he's describing 5.6
 
Oh, well...
There you go then
 
yeah, haven't done too much with my >=7 output yet, but even before the AST, I'm not... you know, nevermind. I suppose it doesn't matter much
 
@Sara but yes, you're right with that.
 
PHP 7's compiler is smarter than 5's
and keeps getting smarter
 
@Dereleased In PHP5, the bytecode was output on the fly, so you couldn't reorder statements.
 
9:22 PM
@Dereleased before 7 we weren't able to reorder instructions in that way… we had to output opcodes the way we got them reported from parser
 
That said, we should probably put thr for conditional at the end and jump down to it for the first loop. Pessimises the single loop case very slightly, but it's very slightly better for the 2+ iteration cases.
 
@Dereleased but actually… good question why we use jnz at end instead of jz at start…
 
Unless, that is, PHP7 already does that. :)
/me spins up her EC2....
 
@Sara PHP does the latter…
 
oh god, union types are even more complicated than I thought
 
9:25 PM
fuck chrome
seriously fuck it and its dead pony
 
and I'm not sure whether that's really the correct way… fewest loops actually are 0/1 iterations
@tereško What did it achieve? crash in a way that it took down your whole OS?
@Sara Are EC2 instances great for benches?
 
it's not showing a cursor in contentEditable tag, IF there has not been any content there yet ... and there was been content, but you deleted it, chrome moves the cursor to the top-right corner of the parentNode
 
@Andrea Are they?
 
Indeed. Clever PHP7....
for($a = 1; $a; --$a) { echo $a; }
L3 #0 ASSIGN $a 1
L3 #1 JMP J4
L4 #2 ECHO $a
L3 #3 PRE_DEC $a
L3 #4 JMPNZ $a J2
 
@Sara yeah, code told me ^^
 
9:28 PM
@bwoebi Dunno. I assume not, since it's all containerized I assume. But it's nice for basic builds.
Yeah, I guess I could have looked at zend_compile.c faster than running it :p
 
@Sara How fast is a build?
 
Of php-src? couple of minutes or so (on a t2.micro)
Short enough that I'm not too bothered.
 
@Sara couple of minutes? That sounds like it's faster on localhost^^
 
I'm on a /pretty/ old macbook :p
But lemme time it...
 
Oh, true … yeah, probably no SSD and CPU > 7 years old?^^
 
9:32 PM
@bwoebi callables
 
Not 100% sure, tbqh. Hand-me-down from Angela, but she was complaining it was "SO OLD"
 
@Andrea that's intersection types?
 
@Andrea Proper callable type hints are ugly-as-hell by necessity.
Which is why.... TYPE ALIASES
 
@bwoebi no? callable|string is a thing
 
@Andrea sure it is
And the issue here is which?
this is pretty unambiguous
 
9:33 PM
er, does the compiler even prevent that?
 
type MyCallable=(function (int): float);

function foo(MyCallable | string $bar): void {}
 
@Andrea sure not
 
how about callable|Closure?
 
@Andrea this is plain redundant
we do not verify at compile-time
but it'll just work
 
hrm
 
9:35 PM
@Sara I was initially going to wonder why it would do the unconditional jump first, but I've noticed that the op arrays generated for substantially identical for, while, and do-while, loops, are all the same, save the missing unconditional jump (to the conditional jump) in the do-while
so that's neat
 
because we typically cannot verify it at compile-time (i.e. with A extends B and B|A - we only could verify after their binding) @Andrea … thus we're never failing these
 
makes sense
202 line function, wow
 
with comments and nice structure
I could reduce it by half and make it unreadable if you wish
 
I appreciate the comments
 
@bwoebi If it was hard to write, it should be hard to read
3
 
9:38 PM
@Dereleased It was not hard to write actually^^
 
@bwoebi I'm not sure what we're talking about, probably should've looked first.
 
9:51 PM
lol
 
transfering a domain between registrars and got an email asking to confirm by clicking a link for approvemove.com. Seems fishy, opinions?
 
Is their a way to convert a v4 GUID to an easy human "enterable" ID number? Such as a short url, or something? IE take the 32 character string into a 16 character or something?
 
@Fabor 404 on index?
 
Yeah :-/
 
Seems odd
 
10:04 PM
Well not 404. Asks for whole link provided in email
 
unless you visit without www
 
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Tue, 31 May 2016 22:04:57 GMT
Connection: close
Content-Length: 315
 
@JustinKaz What is the lifetime of the "enterable" thing? If it's something that's expected to be entered somewhere, you could make a shorter (and shorter-lived) thing associated with it to enter. If it has to have the same lifetime as the GUID itself, then your best bet is probably base36 encoding, because going higher will probably mean involving case-sensitivity, which can be difficult for "human enterable" things.
 
does domainbox or meshdigital mean anything to you?
 
10:06 PM
Nope. I'm going from GoDaddy -> 123-reg.co.uk
 
@Dereleased would base36 encouding the Guid still be unique?
@Dereleased The "typeable" ID has to be the Lifetime of the Guid or atleast the Data Entry people. :D
 
tbf they say their supplier will email me, so though strange may be legit
 
Is it possible to
$url = "http://ipv4.download.thinkbroadband.com/512MB.zip";

$size = array_change_key_case(get_headers($url, TRUE))['content-length'];
$opts = array(
'http'=>array(
'method'=>"GET"
)
);
$context = stream_context_create($opts);
$data = file_get_contents($url, false, $context);
without exhausting the memory limit?
 
@JustinKaz Since they should represent the same number, yes, it should still be unique.
 
10:27 PM
@Dereleased it converted it to 25 characters... which I guess is easier
anyway to make it smaller?
 
the smaller you make it, the more things like case sensitivity start to matter
and you need to be careful about fonts if so, cause sometimes capital 'i' vs lower case 'L' vs the number '1' and so on
 
yeah and those are hard to type...
I suppose once you enter a percentage of the number the system can show likly numbers and/or remember past entered numbers.
my orginal uuid was 25 characters but it was incremental so you would just enter +ijl9 to get the id, it would pad the zeros for you.
 
I'm over here now playing with different ways to represent these things, thanks...
current test bed: 75c6880a-7add-4f6c-8ab9-657834843815
wofd3e-y39bvw-12hodx4-ekklxx
75c6880a-7add-4f6c-8ab9-657834843815
 
I was thinking of the 5 grouping being easier to read off, but it's not quick to type at all
 
yeah, give me a couple minutes
how are they entering these values?
 
10:49 PM
through a data entry system
an online one that uses javascript to be almost as quick as a terminal... almost as quick
 
How do they receive the data to be entered?
do your GUIDs not all have common sequences, btw?
 
no their v4... so I suspect they just have the "4"... lol. Printed invoices.
I almost want to send venders a QR code to include on their invoices lol
these UUID's are starting to become company wide utilized, replacing easier numbers like phone numbers :(
 
I was going to suggest some kind of bar code
 
but that still would "hamper" type time. Stop scan barcode... type... flip page... scan code... type...
I don't want "This system SUCKS" to be the new norm... but I'm gravely considering it.
 
who picked GUIDs?
 

« first day (2054 days earlier)      last day (2890 days later) »