« first day (1502 days earlier)      last day (3429 days later) » 

@DaveRandom No objections. though tbh I'm not convinced that using an async dns lookup with zero configuration is actually the best plan. If people can't be arsed to configure a cache themselves, then they probably don't care that much about the slow down of doing DNS requests in a blocking style through the OS.
 
@DaveRandom Looks like you need a FactoryFactory
 
@Danack Not true, if you are using e.g. Artax good chance you want max speed, also acceptable that "I'm using an HTTP lib, I don't have how the DNS resolver works as long as it's fast"
 
@tereško Wasn't being serious :P
AbstractFactory // effectively FactoryFactory
But yeah, we all talk about FactoryProviderFactoryBuilders anyway
 
4:15 PM
 
lol
 
@tereško that looks good indeed
 
@Jimbo I have a FactoryProviderFactoryBuilderServiceLayerInterface that can help you out there
 
morning everybody
 
user895378
4:18 PM
@DaveRandom I don't see anything there that indicates a bug in Reactor?
 
does anybody here knows how to write a DB/2 equivalent of MySQL's SET NAMES 'UTF8'?
 
@rdlowrey I know. Just have no idea what's going on. All I know is that the PR'd code fixes it, and therefore there must be one, somewhere (since the PR'd change in theory shouldn't ever affect anything).
The thing that I had that caused it was a hang-over from some previous debugging in my code
I am aware it makes no sense
That's why I retained that change, so you can test it out and debug it yourself if you want
 
user895378
@DaveRandom Oh, I hadn't seen your PR yet
 
Oh right, yeh it makes no sense without that :-P
 
user895378
@DaveRandom I see what you mean. Okay. Yeah, I may need to modify it slightly. If I create a separate branch can you test with that in a little while after I push some changes up to it?
 
4:23 PM
Sure
btw @rdlowrey the reason I am using an explicit NativeReactor there is that the UvReactor that select() gave me hung at the end of the script
Do you need to explicitly stop() or is that a bug?
 
morning
 
user895378
@DaveRandom It's likely a bug because each of the reactor implementations should work in exactly the same way (as far as public API consumers are concerned).
 
user895378
@NikiC morning
 
@rdlowrey k, well I'm just ironing out a bug in my own code atm and then I'll verify it still happens
 
user895378
Okay, I'll be working on the NativeReactor thing. Keep me posted.
 
4:26 PM
@DaveRandom even with stop() it sometimes needs a few seconds to abort...
 
Really? weird
 
user895378
Really?
 
or I do something wrong…
 
user895378
I'm going to add a __debugInfo() method to make problems like this easier to debug
 
user895378
@bwoebi It's more likely that something like Artax is keeping a socket connection alive (and therefor socket IO watchers) until a keep-alive timeout is reached and that socket is cleared (along with the reactor events associated with it).
 
user895378
4:29 PM
The reactor won't stop running on its own unless all outstanding watchers are disabled/cancelled
 
@rdlowrey I have two open connections (amp-mysql) then, at some point where I get control back to the Generator in amp-run I execute \Amp\stop(). Then it still needs a second until it actually leaves the Generator.
Not sure, but it effectively might be some timeout there, I just don't know which one then
especially as it always needs just a bit more than one second.
 
Something something connection still open something.
 
0
A: Stackoverflow's use of localstorage for Authorization seems unsafe. Is this correct else how do we strengthen it?

ircmaxellWell, rather than looking at the vulnerability, let's look at the possible attack vectors. Remote Attacker, can observe traffic, but cannot modify traffic Consider this a passive attacker in a coffee shop. They can see all of the TCP level traffic. The requests back and forth to SO are -by-def...

 
user895378
When you call stop() the reactor will finish the current iteration of the event loop -- so if your libs are doing things those operations will complete before things stop running.
 
^^ Another book I wrote
 
4:32 PM
@rdlowrey no, the lib isn't doing anything. phpdbg shows no ops being executed in amp-mysql code after Amp\stop
 
user895378
@bwoebi Then there may be a bug ... if you can create a simple reproduce script I can investigate.
 
define('DOCROOT', rtrim(dirname(__FILE__), '\\/'));
^ I saw this in code that requires PHP 5.3+ >.<
 
user895378
@LeviMorrison hehe nice
 
I believe technically they have a bug that will never manifest.
If you are on Linux and have a directory that ends in \ then it will trim it off ^^
But in any case: define('DOCROOT', __DIR__);
 
@LeviMorrison If you're on Linux and your code is in a directory named *, you get unexpected results when someone tries to use glob().
 
4:37 PM
^^
@DaveRandom You have access to a Windows machine that runs PHP, right?
 
Can you run dirname(__FILE__) and __DIR__ and let me know if there is any difference?
 
@LeviMorrison nope. I happen to know that there is a case where dirname() will convert the type of slash because I've run into it before, just trying to remember what it is
but with __DIR__ and __FILE__ that can't happen
It's to do with reaching the root of the path
Right yeh dirname('/') on win results in string(1) "\"
But afaik that's the only weirdness
 
Thanks.
@DaveRandom A clarification:
define('DOCROOT', rtrim(dirname(__FILE__), '\\/'));
On Windows, doing that in \ ends up with string(0) ""?
 
Nope, C:
 
4:50 PM
... and if you tried to include something like include DOCROOT . DIRECTORY_SEPARATOR . 'inc.php';
?
With that C: path?
 
user895378
Hey @DaveRandom I just commented on your PR ... if you could make that small change I'll go ahead and merge that.
 
I assume it works yes?
 
@LeviMorrison would work fine
The only time you can possibly run into a problem is when the path doesn't start with <drive>:, and that can never happen with __DIR__/__FILE__
And actually, even then it won't cause you a problem unless you try and run it on something that can't handle backward slashes
 
Thanks, Dave.
 
So really, the only time you have to be careful is when you are manipulating paths to use as URIs
@rdlowrey OK so... firstly that would be the same as writing !$this->alarmOrder && !$this->immediates - would you rather have it with the wrapped || parens? And secondly I purposefully didn't do that because it would slightly change what it does
 
4:56 PM
i am using ajaxsnapshot.com in order for google to crawl my ajax content and the support guy has said that Your Hosting provider doesn't support mod_proxy .
all i need is somehow to be able to get ajax snapshots on website so that google can crawl my content. I havent found any good tutoria(thats why i tried ajaxsnapshots.com)l .I know very little javascript. I am using jquery to fetch the ajax contents. i read that i need to implement history.pushSate and htmlsnapshots. I am not using any framework
 
It wouldn't break anything as such, but you'd get an extra potentially unnecessary tick() call
(I think)
I may have confused myself
Asynchronous programming is a bit of a head fuck
 
@DaveRandom no it isn't. Just adapt your way of thinking.
 
Actually that's true, the thing that's a head fuck is the internals of the event loop
 
user895378
@DaveRandom It hurts my head too.
 
user895378
Perhaps we suffer from the same condition: small-brain-itis
 
4:59 PM
Wait, actually @rdlowrey yeh the logic itself is sound
 
user895378
I don't see how it modifies the behavior, but maybe I'm missing something.
 
Would you prefer the !($cond || $cond) over !$cond && !$cond
 
negatives are confusing...
 
user895378
And I do prefer the parens. There's some "law" about this somewhere (the name of which escapes me)
 
user895378
minimize, all of the boolean operators \o/
 
5:00 PM
@rdlowrey Because if would mean that it would never hit the usleep(), but obviously that's irrelevant since at that point you know there's nothing to wait for
 
user895378
Yeah ...
 
So yeh, I'll make the change as-is and just shut up :-P
Actually @rdlowrey yeh I suppose the parens are better anyway because it's a potential short-circuit #MicroOptimisation
 
user895378
@DaveRandom I will try and figure out why the UvReactor doesn't stop for you. Let me know if you discover anything about that.
 
@rdlowrey ty, will check it out when I've fixed my own bug. I've made the change and squashed
It seems to have deleted your comment as well, unless you did it
 
3
Q: How can you apply xss filters in laravel 4 framework?

user2029029How do you think about security in laravel 4 ? I mean how laravel is managing xss attacks ? In codeigniter you have someting like xss_clean($_GET['yourValue']) to clean user input fom xss code. How laravel manage those kind of problems ? You get user values using Input::get('yourValue') but how...

 
5:07 PM
posted on November 26, 2014 by nlecointre

/* by SZIOSI_is_watching_you */

 
Laravel manages XSS by !=
 
@Danack I created a memcached-based Cache impl, not been able to test it as I don't have a memcached server readily available, have asked OP other other issue to try it
@Feeds I... have no idea what that guy was even trying to do.
 
yay! Reddit's down!
6
 
https://slack-imgs.com/?url=http%3A%2F%2Fi.imgur.com%2FD2j11jY.png&width=1178&height=975

What about PHP Devs?
 
5:21 PM
@ircmaxell forever, I hope?
 
@ziGi same as IT consultants
 
@ircmaxell \o/ you can be productive now!
 
@ircmaxell isn't that the bestest framework with the most knowingest community ?!
 
5:36 PM
@rdlowrey I have got simple queries, prepared statements and listen/notify fully implemented and working \o/
 
user895378
@DaveRandom very nice!
 
user895378
I haven't had a chance to play with it yet. I've been crushed under work for these last few weeks. Hopefully this holiday weekend will afford me an opportunity.
 
I still need to revisit your promise/generator based thing for result sets, I'm pretty sure that should be doable by augmenting what I have rather than needing a major refactor
@rdlowrey No worries, it's still pre-alpha anyway, need to implement transactions and cursors yet
Once I've done that I'm going to look at creating an ext/pg based version
 
Nothing like chicken and fries to make me happy again =]
 
.@HotpointUK THERE IS NO SUCH THING AS A HIGH DEFINITION OVEN. STOP IT, NOW.
 
5:45 PM
@JoeWatkins That pissed me off so much the first time I saw it
/me goes home
laterz
 
lata
 
Question for you guys. I hate captcha, I'd like to not use it. But I don't want a bunch of dumb-ass spam coming in through my forms. So I'm thinking about this mechanism:
1) Generate random 12-character string, place it in a hidden field. (named uid)
2) Put half that random string in another hidden field (named uida)
3) Inject the other half of that random string into a hidden field with JS after page loads (named uidb)
4) Submit handler checks if uid === uida + uidb
This is basically assuming that a spam bot does not have javascript enabled or is using a script which doesn't execute the page's js. Valid assumption?
 
@ChrisBaker honeypot
 
@FlorianMargaine ? You're describing the approach as a honeypot, or suggesting something else? Not clear.
 
ah, sorry. I suggested something else.
 
5:56 PM
What does a honeypot look like in terms of a simple implementation to prevent form spam? I just don't want captcha on the site, the folks in the back office say "meh, just don't worry about it", but I see the form submissions we get and there's definitely some non-targeted "you won't believe this deal!" spam that comes in often enough that "nothing" isn't viable.
 
Where the f did the windows download links for php go?
 
You see, comment spam bots love form fields. When they encounter a form field, they go into a berserker frenzy (+2 to strength, +2 hp per level, etc...) trying to fill out each and every field. It’s like watching someone toss meat to piranhas.
At the same time, spam bots tend to ignore CSS. For example, if you use CSS to hide a form field (especially via CSS in a separate file), they have a really hard time knowing that the field is not supposed to be visible.
To exploit this, you can create a honeypot form field that should be left blankand then use CSS to hide it from human users, but not
 
@FlorianMargaine Yes, why is this not linked on php.net?
 
This is literally the only thing that is of any relevance for PHP downloads...
 
5:59 PM
only saw it in the internals ml when there are releases. Never actually used php on windows... except when using wamp. So can't say.
 
Everybody else uses apt-get or git
Also, is xdebug incompatible with php 5.6 or what?
 
works for me
 
@ChrisBaker js submit should prevent most spam. Of course nothing works against a custom bot written for your site.
 
iei, now it works
 
user895378
@NikiC Did you do a recent blog about objects vs arrays or is that my imagination?
 
6:04 PM
@DaveRandom hi
 
@rdlowrey no, I just posted an old one in here because someone asked about it
 
user895378
Oh okay. I thought I remembered seeing something like that in here and had filed it away in my mind for later consumption. But when I visited your blog I didn't see it up top. Thanks :)
 
@FlorianMargaine Ahh, gotchya. I like this better, and it doesn't have the accessibility concerns. I see that article links to a different one where he discusses an approach like the one I was considering. I'm even more glad to see I wasn't in the weeds :)
 
@rdlowrey analyzed the 1-second lag when stopping the reactor. Cause is when the Reactor is stopped in an immediate() and there are read/write handlers (NativeReactor#112), then the stream_select() (NativeReactor#138) is still executed, which has a timeout of 1 sec. Only then control is returned to run() and the Reactor aborts.
 
user895378
@bwoebi I thought it might be something to do with that stream select timeout
 
user895378
6:10 PM
I can address that.
 
@rdlowrey that was clear, I found that quickly in the oplog that this function was called...
(Interrupt with ctrl+c in phpdbg, then I landed in stream_select() call)
 
Interested in practicing your cryptography and puzzle solving skills? Check out the #imitationgame puzzle at http://goo.gl/R41SJ5
 
@rdlowrey Hey... you logged in to leviathon?
 
user895378
@LeviMorrison no sir.
 
I'm just curious because... I tried to restart the machine and it said you were logged in o.O
 
user895378
6:30 PM
uh, weird.
 
user895378
I haven't logged in a while.
 
@FlorianMargaine Hi. Please do u mean that if I hide an input text with Css and I check with PHP to make sure it is blank when the user submits the form I can actually forget about captcha ?
 
@JohnMax hi. No. It means you can try this anti bot technique, and see if it fits your use case.
Especially, if it does stop bots on your site.
Ftr, this technique is called "honeypot"
 
6:45 PM
class A extends B, A calls constructor of B, how can I get the class name of A from B without the namespace, only the class name?
 
@BenBeri using Reflection?
 
Reflection just to get the class name without namespace right?
 
@BenBeri or using get_class?
 
6:51 PM
@JohnMax A big part of this is going to be about volume, and what you do with posted form data. On the site I'm working on now, nothing that gets posted in a form is visible to the public, so there's very low incentive to spam right off -- no one is targeting this site. Also, the forms on the site are stuff like "sign up" or "contact us", which see relatively low volume to our total web traffic. The important thing to keep in mind is that no solution is one-size-fits-all.
 
user895378
7:10 PM
@DaveRandom For future reference, here's the justification for the boolean simplification I suggested earlier: DeMorgan's Law. And here's a related resource that's more about programming and less about algebra.
 
user895378
It's @MathiasV \o/ ... haven't seen you around these parts before.
 
user895378
Good day to you.
 
user895378
@ircmaxell nice! Didn't realize you had a video about that
 
:-)
I hate when code doesn't work
4
 
user895378
7:21 PM
__debugInfo() ... <3
2
 
@ircmaxell I might get downvotes for this, but I think bugs are awful.
 
user895378
@AndreaFaulds -1
 
user895378
bugs keep programmers employed ;)
 
user895378
</joke>
 
@rdlowrey If non-existence of features is counted as a bug too, then definitely yes.
 
7:25 PM
woot, got a timing safe hex2bin function that's only about 20% slower than php's hex2bin
 
user895378
In userland?
 
user895378
Oh okay, still good, but I was like, "woah that's impressive"
 
user895378
s/impressive/impossible/
 
@ircmaxell bitshifting from the negative and then a bitwise and with a negative value… mind-blown… okay
 
7:29 PM
I'm not that smart
 
@ircmaxell well, for a moment I really thought so.
 
lol
 
Well, you're already smart. And then just assuming that you're a bit smarter than I thought isn't hard.
 
user895378
> a bit smarter
 
user895378
no pun intended.
 
7:35 PM
@rdlowrey hmm?
 
user895378
Nevermind. I just found humor in something that was clearly not intended to engender any :)
 
@rdlowrey Yeah, Just wanted to know where you found there the humor?
 
user895378
Because you were talking about crazy bit shifting and then you said "assuming Anthony was a bit smarter" ...
 
user895378
Room 11: where humor comes to die.
 
7:38 PM
@rdlowrey heh, your humor is amusing me :-D
 
user895378
lol
 
A bit smarter is 2x
;)
 
haha
 
@Danack you may want to accept meta.stackoverflow.com/a/277944/871050
It's the official answer from MS
 
^^ He doesn't have to accept it. YOU CAN'T MAKE HIM!!!
 
7:42 PM
ACCEPT IT
 
user895378
He probably isn't even listening on that socket.
 
It was broadcast and forget.
Also, I'm going to be getting a 27" monitor and an SSD from my wife! \o/
 
user895378
Yup. Seems like @Danack's question was transmitting over UDP.
 
user895378
@LeviMorrison nice!
 
Hola bros
 
7:44 PM
"Your computer seems slow lately, sweetie. What do you want for Christmas?"
 
Anybody know good citation material to help my friend learn how PHP and mysql interact? (basically a modern php -> db tutorial)
 
An SSD. Oh, and you were complaining about how small the screen is when we watch movies; how about a 27? "Okay"
 
I haven't really used PHP with vigor since mysql was non-deprecated so my resources are way outdated
 
just sent a mail to internals...
 
@SterlingArcher what kind of information do you want?
 
7:45 PM
@ircmaxell what happened ?
 
He's a noob for lack of better terminology, so he wants to learn not only the syntax, but how PHP works with a database (mysql particularly)
 
nothing, got looped into a thread, and wanted to throw $0.02 in
 
Syntax tutorial I already gave him, so more or less an "Intro to databases with PHP"?
 
I was watching that one ... reading ...
 
I hope I'm explaining this well enough
 
7:47 PM
<-- Is back home from hospital
 
@Fabor congrats!
 
@Fabor get anything good ?? set of boobs maybe ?? a cannon in the chest to strike down your enemies ??
 
heh. Nothing so cool. Feels like someone fused my knee in to my shin!
 
@SterlingArcher what do you mean exactly? how php communicates with mysql? what protocol is used in the communication?
 
Kind of yeah
I found this but I'm not sure how in depth it goes into the db protocols
 
7:51 PM
Pictures if anyone is interested. Little gorey but nothing too bad.
 
If I know him well, he doesn't just want to know to execute a query, he wants to be able to setup a secure db class using mysqi
So connections, errors, security, things like that, but basic level
 
@SterlingArcher suggest just using PDO
it's a lot easier to work with
 
Unfortunately the environment I work in on the game (I'm the owners right hand developer) uses mysql. He's trying to update, but having issues, fell back on mysqli
We know about PDO but that's a task for when we have the time
 
ok
that's fair
 
Hello! I have a question about MVC. If in my app I read information from for example a Rss, that can be considerer that function from repository or repository is only for files stored in local?
 
7:55 PM
 
Yeah, it's a real pain in the ass. But the games foundation is ancient, and there's just 2 of us trying to secure a better foundation, create content, and retain players at the same time. It's overwhelming
 
@SterlingArcher well, are you looking for something written about migrating from mysql -> mysqli?
or...?
 
Not really, I'm teaching a player who is showing promise with code
And he has never used PHP with a database before
So I'm trying to find the best intro to dbs with PHP content that I can for him
 
has he ever used a database before?
 
7:58 PM
No, I'm going to find my old SQL book and try to teach him normalization after we get basic queries down
 
I wont hire a coder who can't design a 3NF database lol
 
third normal form
 
no idea what that is ^^
 
7:59 PM
me neither ...
 
Database normalization is the process of organizing the fields and tables of a relational database to minimize redundancy. Normalization usually involves dividing large tables into smaller (and less redundant) tables and defining relationships between them. The objective is to isolate data so that additions, deletions, and modifications of a field can be made in just one table and then propagated through the rest of the database using the defined relationships. Edgar F. Codd, the inventor of the relational model, introduced the concept of normalization and what we now know as the First Normal Form...
 
@BenBeri Why do you want to do that?
 
Dammit, I can't paste into the SO chatbox again. ircmaxell got it though
 
makes me think of this ... but that's not what you're referring, I guess
 
@SterlingArcher Ah ok. I don't know of any resources for people that new. If you find anything interesting, can you let me/us know? I try to collect decent resources
 
8:00 PM
@ircmaxell of course, thank you
@FlorianMargaine I'm jelly of those ab definitions .________________.
 
oh dear
 
@FlorianMargaine That's not slightly.
 
oh? my bad, then, editing
 
as far as hiring vs not hiring, I wouldn't go as far as not hiring, but depends strongly on the team and the requirements
 
it's disgusting, work, home, anywhere ...
when anyone starts talking about databases, I pretty much switch off ... give me something interesting to do, or some cake, or gtfo ...
 
8:03 PM
@ircmaxell it's unpaid, but myself and ze owner have been screwed over by people who coded the game with improper practices. Basically people who knew how to google for answers, but implemented the worst possible practices. Hard coded data, cross browser complications, etc
 
oh, I get that
but meaning in a company setting
 
yeah the games foundation is a shit storm of bad code.
Oh yeah in a professional setting it's much different
 
wasn't the chap on internals saying we should make all string manipulation functions constant time ?
 
I don't know who said that, but that's insane
 
8:12 PM
well, you only have to make sure that all manipulation are as slow as the slowest one
.. or you could re-implement strings like they are done in erlang
 
hard to think of a time you use bin2hex and hex2bin in a performance sensitive context anyway, dunno why we would argue about 0.5ms ... but I think the original reaction of "stick it on pecl or introduce new functions" was a reaction to the thought of making all string manipulation functions constant time ... it seems perfectly reasonable that hex2bin and bin2hex have these changes applied and say goodbye to the 0.5ms ...
(and others listed, crypt ones are a no brainer) ...
but even if you done all that, as @tereško is saying, wouldn't you still want constant time functions for everything ?
 
also, the steam-sale is on .. but it's a minor one
 
and then in that case, wouldn't it indeed be better to have a securestring class or whatever ?
I said I was watching thread because I'm not comfortable talking about security things, but just trying to be logical @ircmaxell
 
btw, how exactly one would make trim() to execute in same amount of time as stristr() ?
.. just saying
 
that's not what constant time is ...
 
8:18 PM
oh .. mean as in the big O
well, the two example functions stay the same
 
a constant time stristr would take the same amount of cpu time (dependent on length of input) no matter the error conditions or result ... I think ...
 
Comments can't contain that content.

Stating how you voted may distract the author from the important parts of your comment. Please focus on what you found useful or unhelpful about the post.
woah, wait, really?
 
where's that ?
 
yay, yet another question that's answered wrongly...
0
A: PHP security concern

ircmaxellThe other answers are incorrect. So I'll write my own. With the exception of exceedingly rare situations, REMOTE_ADDR is 100% trust worthy. It comes from the TCP connection to the server, so it's practically impossible to forge without actually compromising something on the network (like the rou...

@JoeWatkins I tried commenting "-1 because ...."
@JoeWatkins not .5ms, .5µs
 
saw it few days ago
 
8:23 PM
so tiny tiny number ... I agree it has no impact there, but logically it's not enough to cover those 5 functions or whatever
what's the point in bin2hex being constant time if other functions executed before or after it are not ...
you need the whole api to be constant time, right ?
 
what other functions would be executed?
 
I'm not sure
 
the reason I see it as important is:
 
it's another case, which illustrates, that SO's goal is to "get more users" instead of "get better content"
 
8:27 PM
@SecondRikudo Meh. It's not that great an answer. They're still ignoring the fact that at least 25% of the questions on that forum are just crap, another 25% are completely off-topic for SO (e.g. feature requests) and the rest aren't that awesome to have either. I think there it would be great for large companies to sponsor their own mini-SO site for products which they moderate and answer almost all the questions. But just dumping users here is not that great for anyone.
 
@JoeWatkins substr is already constant time
 
on the decrypt function, compareStrings is written in php to be constant time, I assume that's because it's necessary, which is what I'm saying with fixing those 4 functions doesn't really solve the whole problem if frameworks are still going to have to have stuff like compareStrings in them ...
 
strpos would only need to be constant time if it was used horrifically bad
 
@Danack SE doesn't allow that.
 
@JoeWatkins it has compareStrings because hash_compare isn't reliable yet (it's only in 5.6)
 
8:29 PM
I see
 
I think Rasmus's reply is fair, even though I disagree slightly, especially on context.
 
@SecondRikudo Well the current situation of saying "Go to SO for support" is just a bit nuts imho.
 
@Danack TBH I haven't seen the forum
 
so you don't think a SecureString class is the better solution then, you think fixing those 5 functions is enough ?
yeah, fair ...
 
But Jonathan is one of the top users on SO, he knows what's on-topic and what's not
 
8:31 PM
well, let's go through them
addslashes: impossible to make TS
chop/trim/etc: impossible
chr: should already be ts
split/implode/explode: impossible
count_chars: possible to make TS in certain contexts, but why?
crc32: ha ha ha
 
lol
 
crypt: should already be TS in the parts that matter
echo: why is that a function in strings?
printf: impossible
hebrev: we should make that TS, just for fun
html stuff (specialchars, decode, encode): impossible to make TS
lcfirst/strtolower/upper: nah, not worth it
md5: yes, should be TS
 
@Danack it's "go for web dev support", not just for feature requests and stuff.
 
str_replace, no need to be TS
strpos: possible to make it TS, but I wouldn't
 
Yeah - but "need support" is not "have a technical question".
 
8:34 PM
strcmp: possible, but we have hash_compare
 
Well, it's explicitly the technical questions part of the forum he moved to SO
 
strlen: already TS
substr: should be already TS
 
okay so a pattern is emerging then ... those functions that need to be TS are rarely used in performance sensitive contexts and regularly used in security sensitive ones ...
 
the rest, not really needed
 
patch -> blog -> merge .... go ...
 
8:36 PM
IMHO, the only functions that should be TS are comparison (which we already have), and encoding/decoding (including hash)
 
I'm off to bed, night all ...
 
Mornings
Night Joe.. [=
 
hello all!
would anybody know why a mail() call in php would trigger a click on a link it's sending?
 
good night!
@vimes1984 oO
 
@vimes1984 Yes, yes I would know.
 
8:43 PM
yeah it's weird as hell
 
@vimes1984 Some mail services fetch mails linked in emails for anti-spam purposes.
 
basically I'm sending a activation link with a unique key in a mail function
like so: mail( $to, $subject, "http://www.oifn.ca/newsite/activate/?key=".$key , $headers);
 
@vimes1984 Hmm, try adding a robots.txt?
 
and it always comes back as activated
ohhh i never thought of that
yeah maybe it's the mail service not my php!
 
If that fails, require them to click a button to actually do the activation
 
8:45 PM
adding a robots.txt how
?
a disallow to the link will stop it?
 
@vimes1984 Make just going to the link not do anything, instead you have to click a button on the page first?
@vimes1984 Hopefully...
 
yeah that's a way around it I think
ok
thanks all!!!!!!!!!!
 
and this is why we can't have nice things: news.php.net/php.internals/79201
 
@vimes1984 It's really weird that the mail service is doing that, but unfortunately there's not much you can do
 
been fighting this all day can't find out why it would
if the mail is never sent the link works fine
 
8:50 PM
@ircmaxell I never got your message :/
 
I'm worried about other mail I'm missing now :(
 
@Danack Well I save acl group permissions and the redirect urls for each permission deny of specific user group in a file for each controller, so the perms file need to have the controller's name, that way i can automatically load it from the abstract controller without modyfing. Since my groups are static (always the same) and I only have 3 of them, I decided to use a return array data structure for permissions
 
also: -1 on the "ts_*" approach
 

« first day (1502 days earlier)      last day (3429 days later) »