« first day (1076 days earlier)      last day (4098 days later) » 

09:00
@crypticツ I don't see why you'd need to pay rental on a sandbox...
Seems reasonable, though, as Chris mentioned a "messing about" server can be hosted locally as well unless it must be public.
so i just got access to my online-banking without logging in by simply cloning my sessionid from another pc.

Do i understand this correctly: if i have physical access to a machine, it is nearly impossible to stop me from session hijacking because i have access to the very cookie?
don't even need physical access
look up Firesheep
Your bank doesn't have MFA?
What's MFA?
09:01
Multi Factor Authentication.
@user2422960 That is pretty worrying. Find another bank...
i just need an id and PIN
@user2422960 also 2FA
@DaveRandom +1 and call them about this
Better yet, blog about it.
09:03
i write a post method for import the input data in postgresq database
that is indeed pretty worrying. does anyone have a good lecture on preventing session hijacking?
@user2422960 For one, sessions over https are preferred.
And either don't accept http requests or use HSTS
my bank, for example, has https
Yeah I hope so.
09:04
i get error: Call to undefined function pq_escape_string() in /opt/labscope/htmlapp/accept-term.php on line 40
this is this line
<?php

    $inputString = (stream_get_contents(fopen('php://input', 'r')));

    $post = array();
    parse_str($inputString, $post);

    $_POST = $post;

    if(isset($_POST['weiter']))

{

    require_once __DIR__ . '/../authweb/web/config/database.php';

    $tns = sprintf("host=%s dbname=%s user=%s password=%s port=%s",
        DatabaseConfiguration::$_databaseConfiguration['host'],
        DatabaseConfiguration::$_databaseConfiguration['dbname'],
        DatabaseConfiguration::$_databaseConfiguration['user'],
but nevertheless i could easily avoid the login, why is this?
@Dave-88 shouldn't that be pg_escape_String?
*drone strikes the PHP room* =oP damn dictatorships!
@Dave-88 And please don't paste swathes of code in here.
09:05
84
A: PHP Session Fixation / Hijacking

ircmaxellOk, there are two separate but related problems, and each is handled differently. Session Fixation This is where an attacker explicitly sets the session identifier of a session for a user. Typically in PHP it's done by giving them a url like http://www.example.com/index...?session_name=session...

@Jack thx for the tipp
:)
thank you
@user2422960 What you can do with session id's is not something an attacker necessarily can do.
and sorry for paste swathes of code here
... unless they install a trojan on your computer.
09:06
i find it quite alarming that this would be so easy. never thought so
@user2422960 In a way, you cheated, because you physically stole the cookie - when everything is done over HTTPS this is a lot more difficult for a remote attacker to do. But simply stealing the cookie and plugging it into another machine should not get you into a bank...
@Dave-88 , you really should learn to use prepared statements, otherwise you will have you code vulnerable to SQL injections
yes of course, i know this a unrealistic case. but as Jack emntioned, if i could get a trojan on another users amchine...
@DaveRandom But from the server side the request may not even be distinguishable from the original fella unless you consider user agent perhaps?
And even that can be circumvented.
IP block changes could be considered too.
@tereško okay i do it :)
09:10
But who knows how that will pan out once IPv6 starts to gain popularity.
@Jack User agent, REMOTE_ADDR (for a bank, I would impose that restriction), same Accept: header, all easily spoofable, obviously, but also all pretty reliable. But I say again: I am no expert in this, I'm not about to start telling people how to make secure auth systems.
@Jack s/once/if
My vote would be to throw it out and start again
Hehe
remote_addr is tricky though.
Especially if you consider local "espionage" :)
Using Symfony2, is it possible to use .twig template functions in a Response return? For example:
return new Response('{% block body %}Hello {{ name }}!{% endblock %}');
@DarkAshelin No, Response contains plain content. You need to render it first
09:28
What's a good name for a function that complements parse_url()?
It's unfortunate that it's not called url_parse(), that would make the other function easier to group mentally.
Also, it should probably have been called parse_uri(); but that's besides the point :)
so i have a form action and javascript clickhandler if i click on the submit button the form action load the url but my javascirpt jQuery click handler can't perform audit
Then you're not cancelling the submit event.
okay
must i to set onclick handler ?
try to prevent it $(..).click(function(event){ event.preventDefault() })
If that button inside form, you'd definitely prevent its default event
09:36
yes of course but i use input type="submit" and not input type="button"
and if i use type button
i don't can't post my action
or?
<input type="button"> doesn't do anything, you need to register an event handler to it.
I think I pulled something while sneezing
Hello
I read Symfony2 has autoloading (vendor/autoload.php) to prevent the need of include/require. But why do you still need use path/to/class then?
the use statements are for aliasing
09:43
I assumed use is a method alike include/require
aliasing?
nope
do you know what namespaces are ?
@DarkAshelin Namespacing > directory hierarchy, basic PSR-0
php.net/manual/en/language.namespaces.importing.php so use is mostly useful for setting an alias to it?
otherwhise it is similar to include/require?
atm my use usages in my project don't have any aliases
09:46
@DaveRandom
I read through the link above

would you say that there is something missing in there which i should know or is it quite dic
No, use has nothing to do with include()/requre(). Its not a Perl
*quite comprehensive?
if I'm not setting an alias, what's the difference between use and include?
@user2422960 I am not the best person to answer that question, the best qualified person doesn't appear to be here at the moment
you have a long class name with namespace so instead of having multiple lines with $x = new Foo\Bar\Buzz\Something; all over your code, you write use Foo\Bar\Buzz\Something; at the top of the file and now you can simply do $x = new Something; , @DarkAshelin
09:48
thank you anyways. who would that "best person" be? :D
@tereško oh thx for the info
ah, so even not explicitely setting an alias, it can still take the classname as alias?
and namespaces can be looooooong
use Symfony\Component\HttpFoundation\Request;

now I can do
$request = new Request();
09:49
@user2422960 The author of the post you just read. This may also be of interest - not directly related but similar
@DarkAshelin or , you can do use Foo\Bar\Buzz\Something as LoL; and now use $x = new Lol; where otherwise you would have written $x = new Foo\Bar\Buzz\Something;
@DarkAshelin Also, file that are loaded through the autoloader are totally cached by OPCache. Files loaded through include still take a file request to the hard drive.
again, thank you. great help in here
@Dave-88 your're welcome
@DarkAshelin yes
09:50
ah alright, thx
learning! :D
@ter
@DarkAshelin Yes. But if you wanted to use a MyLib\ClientSupport\Request in the same script, you'd need to alias one or the other (or both) to a different name (use ... as SomethingElse;)
You can't have two classes imported with the same name in the same script.
yep, have experience with that in AS3
09:54
Note also that use is per-script, so if you did use Foo\Bar; in the bootstrap you wouldn't just be able to do new Bar in some file that your bootstrap invokes
How can I get this information to a different page? : $thread['thread_id'] Sessions didn't work for me
E_VAGUE
I can't help but see ternary!
@loko what kind of page to what kind of page? 2 html pages? what have u tried with sessions?
Sessions didn't work because you didn't call session_start() on each page
09:55
@DaveJust I did
@loko On every page??
@Fabien yes
@loko can u post the code u used?
E_INSUFFICIENT_JQUERY then, probably.
Try to echo session_id() on each page, what does it say?
09:57
Page One:
session_start();
$_SESSION['test'] = 'Fab is awesome!';

Page Two:
session_start();
print_r($_SESSION);

So that wouldn't work for you?
throw new NotEnoughjQueryException('Cannot do All The Things');
I do think session_start() was a poorly named. Like many things.
@Fabien Type mismatch: Fab does not equal awesome
;D
I got this:
<a href="thread.php?thread_id={$thread['thread_id']}"> {$thread['title']} </a> which links to the 2nd page.
I've tried to make the
$thread['thread_id']
to a session and I get an error saying: Unidentified variable thread_id
09:58
@Fabien how else would you name a function that should start a session?
hi, @Fabien
Hi @AlmaDoMundo
you should do that via define
@loko Well in that case, somewhere you referenced $thread_id as a variable in itself, not as an array key
@DaveJust Unsure but it's the _start() that is wrong.
09:58
i.e. define('Fab', 'awesome')
:p
Today I am hating Titanium so much. Its not starting my iOS Simulator.
Sorry I am extremely confused right now so please excuse me for my horrible questions but what should I put in the $_SESSION[''] in this case?
@Fabien Since the point itself is to start a session, what makes you think that _start() isn't appropriate?
@DaveJust For a noobie it's easy to assume you can start it on one page and that is it.
@loko you should learn basic things about arrays
10:00
I cant use it like this:$idcheck=$_SESSION['$thread['thread_id']']; can I?
why do such weird thing?
no loko, for starters you are using ' twice in there
and - no, this will not work since enclosed with single quotes
'ception
@DaveJust session_enabled(); perhaps.
10:01
@loko the syntax is wrong itself, it should be $_SESSION[$thread['thread_it']]
@DaveJust Ow yeah of course. Sorry I am really confused :P
damn ... why didn't I write it all in the chat instead (the 600 char limit for comments sometimes is killing me)
@Fabien session_enabled() should return boolean indicating whether sessions are enabled or not. Maybe did you mean session_enable()?
@DaveJust It was just a thought. If session_start() was aptly named then our first assumption when a noobie has a session issue wouldn't be "do you have it on every page".
Hello! :-)
10:05
hello
@tereško why Rails everywhere? Why not Django, Spring - they quite old enough?
Django is a Rails clone
Ok sorry. But My sessions should look like this right? : $thread['thread_id']=$_SESSION['idcheck'];
What was before Rails?
Spring was, Symfony1.x was, ASP.NET Webforms
10:06
@DaveJust horses were before rails
then why developers copied ideas from Rails, not from Symfony 1, not fron Spring?
What are u trying to do @loko?
user895378
Symfony basically copied everything it could from Spring ...
mostly because of the hype .. in 2006th Rails was the king
and if you look at the dates, most of the modern frameworks are newer then that
@DaveJust darkness
10:08
Mine kinder bueno is melted because it was to close to my cinema display argh!
@Duikboot I am trying to get : $thread['thread_id'] to a 2nd page via sessions. But I think it's just not working because of the ['thread_id'] after it. My other sessions do work
$_SESSION['mySession'] = $youdata['balba'];
@DaveJust , the other point that I did not have space for in the comment is that with collection of active records replacing a full implemented model there is no place for "application logic" .. it ends up leaking in the (already destroyed) presentation layer
U have session_start(); on the top of your page?
@rdlowrey Spring wasn't so horrible as Symfony 1.x, so I doubt about it
user895378
10:10
@DaveJust Just because someone tries to copy something doesn't mean they'll do a good job ;)
Yes but I think I fixed it now...
symfony 1.x should have been called "fabpot learns OOP"
Nice!
@Duikboot Yes but I think I fixed it now Just a stupid mistake
fabpot
10:11
sorry .. I always confuse it with fembot
disambiguation
And why DataMappers aren't so popular? What do you think?
because "sql is hard"
@DaveJust because they get horribly difficult once you have to realize object relational stuff with them
No but wait. I dont think a session would do here. I got 2 links. When I click a Link, It should remember the ID number and show on the other page all the information that's with the ID number. Now I am using Sessions but he only remembers 1 ID Number
10:13
@tereško I'd rather say it's the object relational impedance mismatch that is hard.
How do you link to the other page?
@Gordon yeah , but AR doesn't really fix it. It only hides it.
<a href="thread.php?thread_id={$thread['thread_id']}"> {$thread['title']} </a>
@Duikboot <a href="thread.php?thread_id={$thread['thread_id']}"> {$thread['title']} </a>
And that is already working?
yes
10:15
then you got already your ID in ur URL.
@tereško AR is not suited to fix that at all since it's a 1:1 relation from object to table.
i've got a while loop before this one so it makes links of all the title's in the database
How do I show it in the 2nd page then?
at least the information that belongs to the id
when using simply Data Mapper becomes hard, it's a sign that you need to add Unit of Work .. which almost nobody knows how to do
@Duikboot
i've got a while loop before this one so it makes links of all the title's in the database
How do I show it in the 2nd page then?
at least the information that belongs to the id
@tereško yeah, that's what I mean. Once it starts to get more complex - which is usually due to the OR impedance mismatch - things get messy. which is why you want to use Doctrine then because they did that for you already
10:17
This part should Include the ID that belongs to the link from the 1st page: ("SELECT * FROM questions WHERE thread_id = '".$_SESSION['idcheck']."'")
@loko $thing = $this->dataMapper->fetchById($this->sessionManager->read('idcheck'));Do you like how it looks like?
@DaveJust no xd
@loko Does this make a little sense? pastie.org/private/r89kzmvzso6boieibvkisw
loadDetail($thread_id);

function loadDetail($thread_id){ // use your ID to receive the details from that thread.. }
@Gordon .. I wouldn't be so quick to jump to Doctrine. Partially because I do not know how it really works under the hood, partially because I have no trust in Sf2.x affiliates and partially because I have never had a project where "lets use persistence framework" has been the saving solution
@Duikboot loadDetail($thread_id); should do it?
10:22
Fcourse :)
@Duikboot Then I can use the $thread_id in my 2nd page?
wait!
@Duikboot ok
0
Q: Getting some error while opening excel that is generated using PHP

Amit SinglaI am getting the below error while openning the excel generated using PHP code: "Excel cannot be open file "test.xls" becouse the file format or file extebnsion is not valid,verify that the file has not been corupted" And here is the error log for above: <?xml version="1.0" encoding="UTF-8" sta...

@tereško well, the big question is who you trust more. yourself being able to write an ORM or these guys whose software apparently works for a lot of people
10:25
please help me
@AmitSingla verify that the file has not been corupted
@Gordon how can i verify this, please guide me
google how to
@Gordon I don't see how custom-written mappers would qualify as "ORM"
.. also, CodeIgniter too apparently works for a lot of people =P
@AmitSingla do everything that is suggested here: file-repair.blogspot.de/2012/09/…. if that doesn't work, update your question to point out you tried the things given in that article
10:28
0
Q: PHP convert a string array list to Array

Việt Hùng Từ$str = 'answers[0] = "Love it"; answers[1] = "Hate it."; answers[2] = "Doesnt care"; answers[3] = "Like it";' How can I convert it to an array?

Hi,Everyone
@AmitSingla I am putting your question on-hold because its not about programming but about fixing an excel file
I am new comer in PHP.
welcome @NJInamdar :) don't be afraid to ask, plenty of newcomers here ^^
Hello there, it's been a while ...
10:30
Hey @HamZa
But also be aware of the harsh realities that come with PHP! Prepare for the journey of a lifetime!
(I'm SweetieBelle) :P
WB @HamZa LTNS
@Starsong Yeah I noticed :D
I wanted to ask that does anyone here knows how to use phpunit along with zend framework
10:31
@HamZa yellow. After so many days?
@Fabien thx
@tereško my point is entirely about data mappers that require more complex operations stemming from object relational impedance mismatch. basically, if you want to implement all the things in POEAA you are better off using something premade. That's what I am saying.
It's as lively as usual here...
Where have you been?
10:31
yeah :P
I'm still busy though
@NJInamdar zf1 or zf2?
I have installed php unit
ZF 1.11.3
@HamZa Exams?
@Fabien School started, this time it's pretty tough, as in a lot of assignments, new languages, projects etc...
@loko try this : ge.tt/3qOo46t/v/0
10:32
@YogeshSuthar more like, java, C and C# :P
@HamZa cool.
@HamZa Ah furry. Pretty cool though. Wish I'd done it at school.
@NJInamdar ok. prepare yourself for a world of pain.
yeah sure
10:33
@Fabien @YogeshSuthar nothing cool, really. It's quite easy, we're still at loops and creating methods.
@NJInamdar no. really. it's not a joke. Unit Testing ZF1 is a major nuisance.
Luckily I'm doing the fast route, otherwise it would be 2 times slower xD
@Gordon Do you think it's a good idea to have Active Record but in a way that you can swap out "transport layers"?
morning
hi, @NikiC
@tereško Do you agree that MVVM makes more sense than MVC, when deploying on the web?
@Gordon: I'd know.
will have to test the code along with developement.
would be gr8 if get guidence
@Jack what does "transport layers" mean to you?
@NikiC morning
10:36
@HamZa Because you knows all this things from start.
@DaveJust nope. At least not the interpretation of MVVM that I know, where goal of ViewModel is to translate the information between model and view. It's basically aimed at situation where you have no direct control over model's and/or view's implementation.
@NikiC how can I see opcodes for my scripts? (I.e. those which will be used in Zend VM) ?
@NJInamdar try stackoverflow.com/questions/12035924/… and use plenty of google
@YogeshSuthar yeah, there are people here that don't even understand methods ...
@Gordon Sorry, I mean change between, say, PDO and a REST operated DB.
10:37
@AlmaDoMundo using vld
what is it?
a php extension
@DaveJust .. on the other hand, if by ViewModel you mean the lately popular interpretation, then that's just a misnaming of this concept and is part of fully implemented View ... and does not require a new name.
@AlmaDoMundo Alternatively run your code on codepad.viper-7.com and then click "Opcodes" on the right ;)
vld == nice! :) especially if you want to impress your girlfriend =D
@NikiC no, I want offline solution
@Jack If I ever had time to install vld...
@AlmaDoMundo pecl install vld
@Gordon thank you (I want offline since want to launch on my laptop when be on vacation)
I see new people ...
10:39
@Jack I usually not show her opcodes if I want to do that :P
@Jack it's not the matter in my case
@Gordon Yay! "0.12.0 - PHP 5.5 compatibility"
@Gordon They should last longer than roses though.
@AlmaDoMundo Eh?
@Jack You should last longer than roses ;)
@Gordon Which will probably not happen if I show opcodes hehe
10:41
@Duikboot Warning: require_once(so/detail.php) [function.require-once]: failed to open stream:
In any case, is it acceptable to instantiate an Active Record with, say, a Row Data Gateway?
@Duikboot require_once() [function.require]: Failed opening required 'so/detail.php' (include_path='.;C:\php\pear')
why are you thinking that roses are always enough oO
@Gordon:thanks working towards that
... why would anyone have a C:\php folder
10:42
@AlmaDoMundo Why are you thinking that's implied?
@Jack that should be a matter of the used adapter in the AR. I've never had the need to swap out a PDO adapter with a REST based adapter though.
@tereško to install php in... I have that.
@tereško I do
I have not such folder
well .. my php installation (or should I call it "extraction") is dumped in 'C:\Users\teresko\My Apps\PHP'
10:44
@Gordon The reason I'm asking is because the example in PoEAA has SQL code in the Active Record class itself.
@tereško iirc that's where the MSI installer wanted to put it by default, due to some misconception about it not working properly with paths with spaces in it.
@Jack yes. that will make it harder to use a rest based solution then. probably easier to use a RowDataGateway in that case or a TableDataGateway. I mean, you don't want AR for anything anyway because of the SRP violation
@HamZa Even I when I was in school didn't understood what is variable,operators,methods,objects,classes,etc....
@DaveRandom emm .. wait a moment. Are you saying there there is a "php installer"? I just download & extract.
@YogeshSuthar Did you have an IT training/course ?
10:45
Perhaps that could be explained by his bias for Domain Model :D
@tereško There was for 5.2, not sure if there has been since then
@tereško There is, but I prefer the zip file :)
I used it once when I was very green, that lasted about 15 minutes
.. I might have too long long time ago, back in my home galaxy
Yeh not since 5.3
10:46
@Gordon Yeah, in my case the properties literally map to the database fields, so I figured one little shortcut couldn't hurt =D
@tereško I usually dl the zips and then link my php.current folder to it.
@HamZa Nope, All I studied these when I was in school and also learning while doing job.
that' kinda what I do ( just replace the "link" with "overwrite" )
@Jack if the application is small enough it might be okay to so, but it shouldn't be much work to separate them either and it usually pays off ime.
I see
10:48
also, am I only one who keeps PEAR folder outside PHP root ?
@tereško I guess you do that automatically after the first php update ;)
I don't even have one anywhere
@JoeWatkins Are you sure that moving ctor args to new class(...) {} would create unresolvable shift/reduce conflicts? Can't believe this. Then you must just doing something wrong...
I don't think I've ever installed a PEAR package and not been immediately disappointed
I'm sure there are some gems in there but I've never found one...
yeah , after first few "oh fuck, it's all gone"
@DaveRandom phpUnit, phpMD
10:50
exactly
orly? I've always just used the phar
I have a main PHP folder. And in there is the Pear folder as well as all the various PHP versions and the php.current symlink
@DaveRandom "always" so you are using PHPUnit for about a year only?
Probably less, and I still haven't properly got grips with it, it's pretty much at the top of my todo list
(I think it shows through in my code, as well)
so, it's not "used" but "had"
Not completely true, but I'll freely admit that I am not up to speed with a lot of the PHP toolchain.
10:56
Just watching a Clean Code talk on Unit Testing atm.
@bwoebi try it ...
Even if i was forced to use Pear again, the only sane way of using it is to just download the bits you need, extract them and store them in your project's folder, and include them from there.
I'm sure it does, because I tried it ... I'm not sure they are unresolvable but I'm sure they make it more complex ...
@Danack you must hand in your dictionary. Your version seems to be faulty.
10:59
@Danack That basically amounts to not using it...

« first day (1076 days earlier)      last day (4098 days later) »