« first day (1221 days earlier)      last day (3953 days later) » 

user924016
15:00
@Duikboot maybe you could alias it?
I wish we could edit other people's chat messages sometimes...
user924016
@GhostEcho I do not get it
user924016
and could you use a pastebin or similar next time
Good morning
@Ghost
I'm assuming that is the code for two different pages? One which sets the password and one which tries to use it?
15:15
Uhmm....
4
A: Abstract Class vs. Interface

Liuqing HuI'm from China,so the expression is not very accurate. Abstract Abstract Class :focus on a kind of things similarity. Just like regard people as mammalian, U can't regard people as vehicle Interface Interface: focus on a collection of a certain function. For example: U are human being. have...

lolwut?
@Aeolun, yes that is correct
@Ocramius WAT? That explanation and example make no sense to me
Flying shooting people ftw
@Ocramius Flying gun shooting people ftw
15:19
yeah
lolz
Well, there is Icarus...he would implement the Flying interface right?
...who eat eggs. Cause', y'know; $People2->eat('egg');
People extends Mammalian implements Plane
That is just too friggin' awesome
I'm writing another Reflection abomination! YAY!
lolwut
15:21
@GhostEcho: You'd need to not redirect the user to the pages you want to protect, but have the second piece of code on each of the protected pages. Also, you'd just want to exit() in case of an incorrect password, as people will be able to stop a redirect.
class People2 extends Mammalian implements Plane,Gun{
@GhostEcho No it is not. The user will be redirected to a page and if he copies that url and shares it with all his buddies, all his buddies can view that page without being logged in.
Evolution is a bitch
@PeeHaa You're a people and a mammal and a plane and a gun
@PeeHaa s/a bitch/awesome
15:22
class People2 extends Mammalian implements Plane,Gun -- perhaps it's merely a matter of language barrier, but that sounds insane. — Dan Lugg 31 secs ago
@cspray Icarus extends Human and FlyingCreature (multiple inheritance FTW :P)
@Jasper no, that's a frikkin F-18
it has feelings, so it's human
@Ocramius That's a common misconception. CreatureWithFeelings is an abstract class, whereas Human is but one child of it. As such, F-18 inherits from CreatureWithFeelings, FlyingCreature, Vehicle and Machine
@Aeolun, the code is also on the protected pages. If it doesn't match it redirects, it's the first line for each protected page. Beyond the exit, is it ok otherwise?
15:26
@GhostEcho no, meta tags give hints, not rules
@Jasper, that's ok. The password will only be given out to trusted people. The idea is they can tell otherpeople
@Jasper what?
user924016
noooo
user924016
sorry just felt like yelling that after reading the inherits comments above =]
hehe
15:28
@GhostEcho so, basically you are looking for an unprotected content page, and another page that will direct there if people have the correct password?
@Ocramius ^^
Wish I had a boiled egg :(
@DanLugg OSOM
user924016
@DanLugg Mmmm I am going to go boil a couple eggs now
@GhostEcho well, if someone guesses a url, you're still screwed. In other words, you are doing "security through obscurity", which isn't security at all (and yes, that actually happened with a royal speech here a year or so back). You need to protect the actual page, not just the way to get to it.
15:30
good morning room 11
user924016
@Jasper are you using apache?
Morngooting @Orangepill
user924016
Morning Orange
Room eleven; home of the egg-eating human gun-plane.
5
That is some quality photoshop work
15:31
@GhostEcho A meta tag is a hint to the browser, not a rule it has to follow. So, if the browser does not follow your meta-refresh (for example because the user cancels it) he will still see the page he shouldn't have access to, so putting a similar meta-tag on the pages themselves still isn't enough.
@DanLugg Y U NO TWTTR?
@GhostEcho: If you're only protecting one page it may be easier to do <?php if ($_GET['password'] != 'randomblarg') die('you is not allowed here!'); ?> at the top of the page. People would still be able to share the link if they had the password, but won't be able to see it otherwise.
@Ocramius wat?
@DanLugg can't find your twitter
@RonniSkansing I mostly use apache, but not always. Why?
15:32
lol, oh
@dan_lugg, St. Catharines, ON, Canada
35 tweets, 13 followers, following 28 users
Not exactly the same method, but may be helpful.
user895378
@NikiC I'm working on FastRoute tests and getting Undefined offset: 1 coming from Line #33 in the GroupPosBased Dispatcher. I'll be PRing the tests in a couple of hours but consider this a heads up if you want to fix it in the meantime :)
user924016
@Jasper you use apache auth and fail2ban
user895378
@NikiC Happens with these expectations:
user895378
$callback = function(RouteCollector $r) {
    $r->addRoute('GET', '/user/{name}/{id:[0-9]+}', 'handler0');
    $r->addRoute('GET', '/user/{id:[0-9]+}', 'handler1');
    $r->addRoute('GET', '/user/{name}', 'handler2');
};
$method = 'GET';
$uri = '/user/rdlowrey';
$expectedStatus = Dispatcher::FOUND;
$expectedHandler = 'handler2';
$expectedArgDict = ['name' => 'rdlowrey'];
15:34
@RonniSkansing I think it doesn't matter whether I use apache for that, the thing that matters is if @GhostEcho uses apache
user924016
oh
user924016
lol
user924016
yep wrong ping =]
user895378
@NikiC Oh wait ... I didn't realize that the GroupPosBased is supposed to return indexed args and not a dict. Nevermind ;)
user895378
15:37
derp
@DanLugg ^^ Seen several times; still funny.
I know... everytime I read it I still laugh.
user924016
lol
@DanLugg Why did you blur your avatar?
15:39
@PeeHaa I see wat u did thar.
:-)
The reason is, I didn't want people knowing I use Firefox ;-)
@DanLugg I'm so used to randomly having firebug open that it took me reall long to understand that one
@RonniSkansing Any reason you prefer fail2ban over denyhosts?
user924016
@PeeHaa no not really, I am not a server guy =]
user895378
15:43
@NikiC pfft, now I'm just confusing myself. Please take a look at the link I mentioned earlier. Still getting notices and don't feel like debugging it myself.
user924016
But I would love to here some arguments for denyhosts
Ow I don't have any just curious whether you had :)
@Aeolun each page has something like that. What I'm most concerned about is some type of injection method to make it true in the input field. Something like ' or 1=1.
http://stackoverflow.com/q/21858047/1723893
and ^^^
@GhostEcho If you're not forcing SSL this is a horrible idea.
15:55
Morning room 11, am facing a Mapping dilemma, any help would be greatly appreciated. My domain logic is all done, now it comes to persistence as per Data Mapper pattern. First of all, I've decided not to implement a complicated query builder into my DBAL. Instead, I will write SQL queries (most of the select queries have JOINs) into a Mapper. Any objections so far?

Now, I'm confused as to which approach is most suitable. To write **finder methods in a mapper** or to write **finder objects**. Although surely there are, I don't see the benefits of using one over the other. Can anybody elabor
Anyone with a packet sniffer on your local network or user's local network will be able to intercept the password.
pinging all @PeeHaa 's
@GhostEcho unless you are using eval() it shouldn't be a problem. 'passstuff' == 'passwordblarg && 1=1' will never match.
@Lusitanian Nope, not all of them. You're not pinging my brother for one...
ping @JasperHaa
15:58
No, I share a last name with my brother not a first name
user924016
@nicks I am not sure what the difference in your example is between "finder methods in mapper" and "finder objects"
@nicks That sounds sane to me... that's the problem a mapper solves, when your object model and your storage model deviate. Personally I see nothing wrong with adding finder methods to the mapper but some purist might think that's making the mapper have two jobs instead of one.... not only would it have to know how to persist the object but also know how to construct them
Oh, and neither will it if there's a ' somewhere in there. It's not directly entered into your PHP code.
(and the joke is that PeeHaa is just P.H. pronounced in Dutch, which are PeeHaa's initials as well as my brother's)
@Aeolun thanks
16:00
@GhostEcho just don't try porting the same code to SQL, but then you will have the issue :)
> Reply from PeeHaa: bytes=32 time<10000000000ms (in conference call atm) TTL=63
@RonniSkansing @Orangepill It sounded the same to me too, it's something i picked up in Fowlers PoEAA. I suppose orange is right and Fowler suggests to split it up in order not to break with SRP? You agree?
@PeeHaa 115.741 days...
@amal completely
user924016
nicks Fowler said in that same book "Patterns are halfbaked"
16:05
@Orangepill My mappers aren't responsible for the creation of objects. Instead I pass in an instance of an object and let the mapper "fill it with data" accordingly
@RonniSkansing better half-baked than raw?
Point taken Ronni!
user924016
@Gordon =] yea
user924016
@nicks another phease fowler qoutes is
@SuhosinPony They'll be pretty much able to do that however you try to get the password to the server if you don't use SSL (unless you first hash it on the client side).
user924016
16:07
A pattern should be usable a million times without having the same code
user924016
=]
PHP should have larger filter library.
@DanLugg it supports every filter you want through FILTER_CALLBACK
I know, but I can achieve that in multiple other ways; more built-ins
16:11
However, I have an errata for my previous message: PHP should have a larger better filter library API.
@rdlowrey I tried this code:
Apologies for wall of text, but this needs reading:
$dispatcher = FastRoute\simpleDispatcher(function(FastRoute\RouteCollector $r) {
    $r->addRoute('GET', '/user/{name}/{id:[0-9]+}', 'handler0');
    $r->addRoute('GET', '/user/{id:[0-9]+}', 'handler1');
    $r->addRoute('GET', '/user/{name}', 'handler2');
}, [
    'dataGenerator' => 'FastRoute\\DataGenerator\\GroupPosBased',
    'dispatcher' => 'FastRoute\\Dispatcher\\GroupPosBased',
]);

var_dump($dispatcher->dispatch('GET', '/user/rdlowrey'));
user1607528
Hey folks, is it possible to connect to an online mysql database through xampp localhost ?
16:11
For readability I'm going to go with tons of finder methods in one Mapper (breaking SRP) rather than stuff my file structure with classes like "MovieFinder", "AvailableMovieFinder", "MovieFinderForHomepage". Thanks for taking the time to answer!
And I didn't get any notices
Particularly this bit: "First of all, this behavior is not a security issue in Composer. While the behavior is unintuitive, it will not result in malicious code being used if you use Composer correctly.

Most importantly you should only ever run composer update yourself manually on your development machine. You should read its output, verify it installed and updated packages as expected (use --dry-run to check what would happen without installing anything)."
My guess would be that you switched the dispatcher, but sticked with the other data generator :) Those two are always paired, can't really change just one of them.
/doing it wrong
@NikiC OT: any chance to catch you at some conference somewhen?
user895378
16:12
@NikiC Ah, that is my problem :)
user924016
=]
@PeeHaa lolol
@nicks but then you would know immediately by looking at your folders what the application can do
@Danack I already told naderman that such a thing is just broken - I used to run composer update in my CI environment, for example
It'd be nice if this were the approach:
bool try_filter_var(int $filter, mixed $input, [mixed &$result = null])

mixed filter_var(int $filter, mixed $input) throws FilterException
user924016
16:14
[, mixed ..
user924016
=]
user924016
the , is optional
^^ eff you. ;-)
user924016
haha
@Ocramius It's the 'read it's output and check it' that gets me.....how can people even suggest doing it like that.
16:14
Well, he's actually right
user895378
@NikiC I'll PR tests today. Also, a couple of things to think about. Probably need to add some kind of "coalesce_head_to_get" option because the HTTP spec requires that all servers support HEAD + GET for every resource. The way the PHP web SAPI handles this is that HEAD and GET are usually treated the same way and then only the resulting headers are sent back to the client (sans-body).
but it should really just warn/stop on risky operations
@Gordon Saving me the immense trouble of opening the mapper file to find out? Versus the configuration hassle (i use a zend style service manager) of having to register all these separate finder objects
user895378
@NikiC So to avoid users having to manually specify a HEAD route for every resource we should probably enable the option by default to route to a GET handler if no HEAD handler exists for a given resource.
@nicks ah, so it's a tooling problem :)
16:17
@rdlowrey Yeah, I figure there's some things off from the HTTP side. Checking for GET if HEAD doesn't exist seems reasonable
not neccessarily, but if i'm going to break with SRP or the pattern as described in PoEAA it only makes sense to go with the solution that takes least effort in my specific case ;) just weighing my options
Anyone know a Meta Package Manager that supports npm, bower and composer? I'm sick of having three of them
user895378
@NikiC I'm pretty sure that's the only other thing HTTP-wise that needs to be considered. At some point I'll PR something to allow automatic content-negotiation, but that's not super high priority.
Imagine if I didn't have that service manager, oh the extra dependencies having separate finder objects for everything would introduce
@nicks yeah, but each time you add a method to that finder you're gonna lower the reusability of the thing
also, it makes slicing the application into discrete packages harder
@Gordon You're right. Not something I wanna take for granted. Perhaps finder objects are the better way to go. Thanks
^ @raman
wat. Any security that depends on programmers being 'careful' is inherently going to fail.
Personally I think the ability to 'replace' packages should only be allowed in the root composer file of the project - so you have to explicitly list the replacements. It's really not that big of a job.
@Danack that's what is being implemented, yes
16:23
@nicks "You're right. Not something I wanna take for granted." I always right. You can take that for granted ;)) </irony level="medium">
seems like since what I proposed github.com/composer/composer/issues/2690, it was considered a "feature"
is Madara in the top 10?
@SuhosinPony thanks.. do i need to add new question there
for the samee
@raman Yes
@SuhosinPony ok
thanks
16:24
@Ocramius I haven't been to any confs yet. On the other hand, I also won't be able to avoid going forever ;)
@Ocramius That's not how I read the this - it says that any package that is listed in the root composer file, can be replaced - not just that the replace keyword works only in the root file.
@NikiC yes, indeed - so what do we have to do to get you into public speaking?
learn german?
user924016
Hmm.. learn sass or less?
@Danack meh, german is horrible - I already use it to go "outside", where the other humans seem to spend their time
@Danack yes, the idea is to use the required dependencies' names to apply "replace" and "provide" instead of automagically looking in packagist (which is just plain stupid)
16:27
@Jasper Not sure whether I added anough 0s so added a few extra to be sure :P
yes/no? jsbin.com/yawuyemu/1 view source as well
@Lusitanian hoi
@PeeHaa a'hoy
@Ocramius ah right - but that is what Mr Adermann currently describes as "this behavior is not a security issue in Composer. "
16:29
please help me
2
user924016
@raman please do not dump some code in here =]
@Ocramius Timely reminding me about php confs in berlin might help ^^ might
@RonniSkansing sorry i have not throw any dump data...
@Danack yeah, but it is IMO
morning
16:31
@crypticツ I take it there is no easy way to implement a copy to clipboard button without flash?
@NikiC if you submit for PHPDay I may submit as well just to get to meet ya :D
@PeeHaa You can use Java!
user924016
@raman yea I just read up the chat transcript. I feared next up would be a code dump. =] Have you read wordpress.org/support/topic/using-session-in-wordpress
BTW +1000 for the categorizing @crypticツ
@Danack :)
@PeeHaa already looked into it, and yeah only flash way =o(
16:32
Thought so :(
@PeeHaa y ur server no work with teh ssh authz
Not sure yet. I'm going to nuke your account and create it again when I get home. I'm sure I did something stoopid yesterday
@PeeHaa the only cross-browser way is Flash. There is such a thing as HTML5 Clipboard API caniuse.com/#feat=clipboard
cc @crypticツ ^
@PeeHaa yes you did
16:41
:)
hmmmmmm
Is there actually any reflection API giving me all inherited private properties? O_o
user895378
@NikiC Okay, I have found an actual issue (a real one this time). In cases where a static route URI match exists but no appropriate method is found the dispatchers won't return the "allowed methods" array at index 1 of the returned route info array.
user895378
So you may want to cache the available methods for a given static URI so that you can capture those with an isset check or something.
@rdlowrey Whoops, you're right. I must have accidentally removed that from the original implementation
user895378
It's okay, that's an easy one to miss. The tests I PR will contain cases that test for that so it should be easy to tell once you fix it because everything will pass :)
16:54
@rdlowrey should be fixed now
user895378
@NikiC Awesome. Everything passes. Test PR coming your way in a few minutes.
user895378
> OK (30 tests, 78 assertions)
user895378
@NikiC The only additional thing I had to do was separate functions.php from bootstrap.php so the lib would play nice with alternative autoloaders. This needed to happen for composer anyway, but it was also necessary to get things loaded correctly via the phpunit test/bootstrap.php file.
17:10
@rdlowrey annnnd merged :)
thanks a bunch!
user895378
17:21
np
user924016
Any suggestions on alternatives to watchr?
> Sheet represents the name of the sheet. It must be placed in double quotes.
but none of the formulas in libreoffice will give me the name of a sheet
only a number
this means I now have to either rename my sheet names to be numeric or write Jan-Dec into my formulas
@Gordon Are you allowed to embed some VB (or whatever that is) ask.libreoffice.org/en/question/16604/…
@Danack its my own sheet so i guess i could
But the solution there will only give you the current sheet name
and I need the sheet name of sheet 2 to 13
to make matters worse, there is also no function to give you the abbreviated month name
ThisComponent.getSheets().getByIndex(nSheet-1).getName()
That doesn't reference other sheets?
And LibreOffice doesn't have the VB libraries? "MonthName(10, True) => Oct"
18:45
Also, the only good VB is this one.
Mornig
After trying my password at least a dozen times, trying several other passwords numerous times and wondering how that password could be wrong, I finally realized I was trying the right password in the wrong VM...
Derick Rethans is meant to be giving a talk at Bristol PHP meetup group in a couple of months, but he asked what we want him to talk about - anyone have any idea what we should ask him to talk about?
Other than why is internals such a shit show.
> Warning: PHP Startup: It is not safe to rely on the system's timezone settings.
18:53
@PeeHaa FFFFFFFFFFUUUUUUUUUUUuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu...........................‌​...
My brain had blocked that.
lol
@Danack That and what his thoughts are about phpdbg
Morning!
Speaking of which is @JoeWatkins still alive?
user895378
@NikiC I just sent one last PR to address the HEAD routing question. If you wanted to optimize the behavior to avoid an addition preg_ call you could, but honestly I don't think the utility you would derive from such an optimization would be worth the effort since it's really just an edge case.

« first day (1221 days earlier)      last day (3953 days later) »