« first day (1794 days earlier)      last day (3380 days later) » 

19:00
I told my client that we need to upgrade already, but he told me it would break stuff and "please don't touch it"
@kelunik Dates always in LINT timezone.
It's until sept 14th... not through sept 14th
Salt is random data used to prevent pre-calculating secure hashes like passwords. It can be public, but should be different for each securely hashed value. Ideally, salt should be generated from a CSPRNG. If a cryptographic function offers to generate its own hash, let it. Don't provide your own if you don't have to.
@Orangepill is until inclusive or exclusive?
@ircmaxell oh! it is yours ..! good!
19:03
@Sajad that's a compatibility library for pre-5.5
(And yes, I know the question "What is salt?" was removed, but if someone asks about it, they should know certain key things about it, like not generating your own when you don't have to.)
@bwoebi when my mom told me i had until the count of three to do something when she said three it was too late
@Orangepill I'm the one who joked that it was still supported in my time zone. :P
@tereško ah !
2 mins ago, by bwoebi
@Orangepill is until inclusive or exclusive?
19:05
Oh yeah, missed that.
how can I see which stuff i need to change/do to upgrade to 5+
which one is better? PASSWORD_DEFAULT or PASSWORD_BCRYPT
@Ekin Have a development server, upgrade to the latest version of PHP... see what breaks... Or you can look at the changelogs and go through your code with a fine toothed comb...
^ just found that one - alright thanks
19:08
6
A: Is "until" inclusive or exclusive?

Joetl; dr - It's exclusive if the situation described is notable by its absence. It's likely to be inclusive if the situation described is notable by its presence. At its heart, until describes when the transition happens. If you say "X until [time]", you mean that X becomes not-X on [time]. The...

@tereško do you know what version of php I installed on my vbox (freebsd) ?
@Orangepill at least this answer tells me it's inclusive for this case.
Do people have more name suggestions or should I just put up a poll now? gist.github.com/PeeHaa/129ee4eb16ee4b0bbf80
@Sajad IIRC , 5.6.10+
ok tnx
19:09
@Sajad PASSWORD_DEFAULT. Right now they both do the exact same thing, but in the future if bcrypt is found to be insecure, or a more secure function is used, then the better version will be used automatically.
@Sajad php -v
@Ghedipunk ah alright, tnx
@Sajad btw, you should upgrade your installed software one per month, IIRC, the command was pkg upgrade
@tereško and I need to config them again? (if I upgrade them)
ok good!
19:11
@PeeHaa devbase - if you really but all that in. or then devcloud if it's really useable out-of-the-box (whch is a lie, we know, but if it's so close tot that lie :))
though, you will need to restart the relevant services
@bwoebi "likely" inclusive
not that it matters anyway
@tereško I knew it ;-)
@hakre It's as close as possible to that lie
"go to devbase, checkout the main project and then push back changes to trigger CI."
oh that would be really nice. owncloud for developers.
19:12
and now I will check whether I made a good gazpacho
count me in to start the propaganda.
@tereško what is gazpacho? and also your mean of "IIRC" is "If I Remember Correctly" ?
@hakre :-)
@tereško :-)
ah !
19:15
duckduckgo.com/html/?q=gazpacho <- doesn't have pictures but keeps your privacy.
btw, wikipedia has pictures, in case you're looking for some
:25702302I'm wonder, how can you live alone?! you cook, you clean the home, you buy food, you wash dishes and clothes and ...
it is really hard for me
most often it's the dose of inviting friends to eat, the wine and enough garlic.
:-)
Anonymous
Oh, living alone is making me age faster definately.
ok, there is a problem, If I story the hash of password in the database, so if user forgot his password, how should I show him ?
19:20
"age" and "grow up" is no the same
@Sajad if user horgets the password, you have to provide a way to reset that password
@tereško just restart ?
Anonymous
@tereško check context
maybe he wants to continue with old password
Anonymous
@Sajad The password has to be changed.
@Sajad How would he know? He forgot it...
Anonymous
19:21
Also ^
Anonymous
He has evolved into forgetting what to ask basically.
@PeeHaa but If I don't storing the password as hash, I can show him
@samayo ok
@Sajad no
Anonymous
@Sajad allow the user to create a new password. That is the only sane way to restore a forgotten password.
@samayo ok, I will do that, tnx
19:24
I have 6tasks awaiting but the urge to read a few more bleach eps is so strong
@Sajad Why would he want to continue with an old password when it is just established that he doesn't know it?
Anonymous
I'm assuming he thinks, one does not forget the same password twice.
Anonymous
It's kinda a good argument, if that was the case.
posted on September 14, 2015 by nlecointre

/* by aurel */

19:35
On the password storage cheat sheet, the key points:
1) Do not limit the character set and set a very long limit to the number of characters, if you have to set a limit.
2) & 3): Use a cryptographically secure salt AND use an adaptive one way function: In PHP that means password_hash() always.
4) Design for eventual compromise: NEVER STORE A PASSWORD IN PLAINTEXT.
Anonymous
It seems a bit overkill. I would say [1] when user submits email, if email exists, send token to email and update user record with token. [2] if user clicks password reset link ex: host.com/pass/recover/token then validate and update password from from.
What would an authenticated user on your site be able to do that a non-logged in user would not be able to do?
(Including do to themselves)
Anonymous
anything that's on the table
@Ghedipunk compromise in which sense? why is the word compromise used as point 4) at all?
Assume that a malicious person will be able to read and store your entire database.
19:48
@Ghedipunk if the answer is: nothing as long as the cookie is the same, then this is wrong and requires you to put some steps behind a re-authenticating step at least.
@Ghedipunk or at least all account informations including the persisted passwords I guess.
@hakre I assume that cookies are always compromised. The OWASP recommendation is to invalidate all session IDs when someone logs in, logs out, escalates privilege levels, etc.
@Ghedipunk Why are cookies always compromised?
@PeeHaa Because they're completely under user control......nothing in them can be trusted. Which is different to session data...
@Danack Yeah ok, but resetting cookies / sessions doesn't solve that
@PeeHaa Not everyone types "https" when going to a site for the first time each browsing session, or has the TLS version of the site bookmarked. Even if a site automatically redirects to the TLS version, that data is in the clear...
19:56
@Ghedipunk cough hsts cough
I assume even IE supports the chrome's hsts list by now
That's a good layer in security. Still not enough to convince me not to invalidate session IDs, though.
Don't get me wrong I do it too :-) Just wanted to point it out ;)
Hmmm even IE11 supports hsts preload list now
yay for ie
@PeeHaa IE11 wants you to think it's Chrome. So does Edge. So shhhhh
@Machavity Edge is just a terrible terrible browser
Some much broken stuff
"Microsoft Edge! Let's take off your mask and see who you really are... Internet Explorer!?!?!" "I would have gotten away with it, too, if it weren't for you meddling kids!"
20:03
@Ghedipunk It's actually worse than IE :P
Edge = IE11 - ActiveX
The Scooby Doo villains with their masks are always worse than without, too... ;-)
hehe
Announcement: Core of my chat project is now open source: https://github.com/kelunik/chat
7
@ircmaxell To be fair it does use strtr :D
20:07
^ @PeeHaa @samayo @marcio
Anonymous
@kelunik Good move. I'll check it now.
Anonymous
I didn't know it was made with PHP.
Anonymous
How are we supposed to try this without some front-end code?
@samayo The underlying server isn't open source yet, but that doesn't matter as there is a clear separation from it.
Trying it out isn't possible directly, currently you'd have to create a web SAPI bridge for it. There is code in another (currently private) repository having that bridge for Aerys, but as Aerys isn't open source yet, so it doesn't make sense to publish that now.
@samayo Oh, and there's no front-end for the new API yet. :-D
Anonymous
awesome
20:20
@Ghedipunk thanks buddy
@Orangepill yes you are right, I just let him to restart his password.
It shouldn't be an issue to put Laravel in front of it now. :-D
\o/
@PeeHaa what is its mean ?
and also this: o/
o/ = hey / bye / heil
\o/ = yay
This is a list of notable and commonly used emoticons or textual portrayals of a writer's moods or facial expressions in the form of icons. The Western use of emoticons is quite different from Eastern usage, and Internet forums, such as 2channel, typically show expressions in their own ways. In recent times, graphic representations, both static and animated, have taken the place of traditional emoticons in the form of icons. These are commonly known as emoji although the term kaomoji is more correct. Emoticons can generally be divided into three groups: Western or horizontal (mainly from America...
20:29
ow :-)
@PeeHaa that must be an american thing
@tereško why american? they are lazy ?
@tereško hehe
@Sajad on average they probably are as lazy as everyone else, but it's a country of extremes
20:40
ah
Anonymous
@PeeHaa nope :P
15 messages moved to bin
@tereško Well put..
@samayo ;-)
damn @PeeHaa I was just reading that x(
^^
20:42
@MarcelBurkhard You can still read it in bin.
@MarcelBurkhard The bin never forgets
:)
@PeeHaa thanks. (for binning.)
I tend to clean up after myself unless I am drunk. In which case I expect somebody else to do it for me :P
gonna try playing some Serious Sam
20:45
@tereško How retro
well, it's the 3rd (before first encounter)
been trying to put some dent in my played-to-owned ration on Steam
@tereško hehe you've been going on a sale rampage again?
nope
20:56
@Orangepill "well put" means they did a good work that have put a escalator in there ?
Anonymous
When Ajax-based web pages show an entire block or content area instantly, do they just use innerHTML or create DOMs, textnode and all the rest of the html?
@Sajad it was praise for teresko assessment of the american condition...
@Orangepill aahh ! I see
@samayo usually innerHtml
@samayo Either seperate items are appended or developer.mozilla.org/en-US/docs/Web/API/DOMParser
21:00
@samayo They should manipulate the DOM. Most set innerHtml. The best practice that nobody takes the time to do is, create a div outside of the document, set its visibility to hidden, create the structure, add to the document in the desired place, then set its visibility to visible.
@samayo in my experience most use a client side template to create the html then just set it via innerHtml
Anonymous
@Orangepill I can understand why. I just know didn't like using innerHTML but creating elements for large data would be a nightmare
@samayo and it's very context based... so the opportunity for reuse is pretty low.... but with templates it's a generic solution
Anonymous
@PeeHaa > IE9 :/
@samayo Stop supporting old crap :)
21:08
protip: stick __halt_compiler mid-way through a PHP file containing critical functions. your co-workers will tear their hair out.
4
Even better, change your autoloader so that it will load a file containing __halt_compiler randomly. Tune it so that it only fires about 10% of the time (i.e., if your scripts typically autoload 100 files, set the probability to 1:1,000)
@Andrea IDE will see it though…
@Ghedipunk doesn't it only apply to the current file?
@bwoebi do any IDEs actually check for it?
\o/
master is branched off
(from the PHP-7.0 tree)
Let's start 7.1 dev!
@LeviMorrison :-P
@bwoebi already done
21:18
@ircmaxell I mean actually merging things^^
@Andrea After reading the docs... Yep, I confused it with various Halt and Catch Fire instructions from other languages.
@Andrea at least PHPStorm does.
@bwoebi heh, that makes sense I guess, it's like Perl's __END__
@Ghedipunk PHP's compiler runs once per file, it doesn't compile the entire app as one blob like a C compiler
the include statement isn't a preprocessor directive. It's actually the same as eval() and invokes the compiler
that's why conditional includes and such work
That's why we're not writing #ifndef header_h... ;-)
@Andrea oh, well. then eval(file_get_contents(...)) with random truncation after a semicolon… then add missing }.
21:25
@Ghedipunk mhm
@bwoebi heh
@Andrea I really should stop giving you diabolical ideas :-P
@bwoebi You'd also have to close any strings with the right string delimiter...
which part of this URL http://localhost/menuname.de?foo=bar&amp;number=0 is path ?
@Ghedipunk not if you do truncation at the token level
@Sajad /.
21:27
@Sajad /menuname.de
@Sajad PHP has a function that breaks down URLs into parts, if you're curious
@Andrea path in not containing any arguments ?
@Andrea Would have to be at the statement level, if you don't want to add in arguments to finish out a function call...
@Sajad arguments are called a 'query string'
@Andrea ah I see, tnx
@Ghedipunk we're only cutting at semicolons, though
21:28
hello guys
@Andrea and what is the name of that function ?
I don't think they can exist inside function calls, aside from closures I suppose
@Sajad parse_url
@Andrea tnx, I will read about it
can i use print to include a js and css file into my.php without using html code at all
@Andrea sorry for asking again, but do you know what is the name of this part http://localhost/ ?
21:30
in other ways i'm asking if it's possible?
<?php
	print'
		<script src="src/sweetalert/sweetalert.min.js"></script>
		<link rel="stylesheet" type="text/css" href="src/sweetalert/sweetalert.css">';
@Sajad that would be the host
localhost is a hostname
ah ok
@Andrea That'll work. Usually safe. If not, well, we're still looking to introduce errors in places where it's obnoxiously difficult to find them, so it'll do the trick. ;-)
21:34
@andrea you get your talk all written?
@Orangepill I really need to
@Orangepill that was helpful, thanks !!
@Sajad URL parts definition:
protocol: "http:", "https:"
host: "localhost", "example.com"
path (resource): "/", "/my-directory/my-file.html"
query string: "?param=value", "?param1=value1&param2=value2"
fragment (named anchor): "#something"
@Ghedipunk ow great explanation, very thanks, if it was as a answer on the stackoverflow, I give you +1 upvote ;-)
@ghedipunk you forgot the authorization portions of the url
21:37
@Orangepill I also left out the port number.
@Ghedipunk what is mean of "left out"? google.translate has not its mean
@kelunik usful! tnx
@sajad omitted... or did not include
To leave something out is to not include it, usually on purpose. "Left" is the past tense form of leave, in this case, rather than the direction.
We've issued our first certificate! https://letsencrypt.org/2015/09/14/our-first-cert.html
21:39
@Orangepill ahh I see !
and my last question for tonight: is it possible to I put a javascript variable in the php session?
I want put this variable on the php session:
var url = window.location.href;
@kelunik cooool
It's not cross signed yet, but \o/ – Beta submissions are also available now.
@Sajad Possible, yes. You would typically do an AJAX call for something like that, or set a cookie so that it gets sent to the server with the next request.
@Ghedipunk ah ok! can you tell me what should I search for getting more information about it ?
@sajad you can via an ajax call or you can just use $_SERVER["REQUEST_URI"]
21:45
@Orangepill oh thanks !
:25705668 That's the PHP version of Javascript's window.location.href.
That's another thing that gets misused alot... uri vs url
imo it should be REQUEST_URL
@Orangepill okey!
@Sajad "AJAX send data" seems to be a good search term.
@Ghedipunk ok tnx :-)
@Orangepill URI is correct
21:48
@Sajad lol this always confuses me as hell, though i'm using both lang variables in other , like php ones in js and js ones in php in my web, but everytime i need to do it again i've to consult the internet again and again
@HassanZia :-)
anyways what's up with your site?
is it on air?
ajax request is not useful in this case. I want when user clicked on the bottom, current url passes on the session, is it possible?
$_SESSION["current_url"] = $_SERVER["REQUEST_URI"];
@Orangepill i'm in javascript not php. I need to define a condition: $('.btn').click...
22:01
@Sajad If you're submitting form data, you could make the current URI a hidden form field. Use POST not GET.
@Ghedipunk there is not any form!
@Sajad You already know how to get the current url in javascript or in PHP ... I don't know what more information we can give you here.
All those different favicons and related stuff are kinda craaazeeeee github.com/CodeCollab/Demo/commit/…
/rant
There needs to be a web request of some sort in order for the PHP session to get client-side data. The PHP session exists only on the server, and the link link between the client and that session is their session ID, which can't be messed with on the client side without starting a whole new session (or taking over someone else's session, which is bad juju.)
@Orangepill ok bro, tnx
22:06
So, either submit a form, submit an AJAX request, or load a new page. If you don't do any of those, you're not getting the client's current URI.
$_SESSION["previous_url"] = isset($_SESSION["current_url"]) ? $_SESSION["current_url"] : "";
$_SESSION["current_url"] = $_REQUEST["REQUEST_URI"];
@sajad with that you can get at where you came from and where you are at.
(The null coalesce operator can't come soon enough. Hurry up, core PHP group. I know you have a timeline, but just release 7.0 already!)
amen to that
22:09
@Ghedipunk You can have it now, no need to release it now. ;-)
@Orangepill no no, I don't need to php codes, I just have a button and I want when click on it, current url goes into a session. I think I need to js code
Are there legitimate use-cases for __halt_compiler btw?
IIRC, only phar uses that stuff, no?
$("#voteup").click(function(e) {
   // pass current_url in the session
});
$(".btn").click(function(e) {
   // pass current_url in the session
});
$(".btn").click(function(e) {
// Put your AJAX call here.
});
@Sajad where is you session stored?
22:11
I give up on the formatting... :P
intent is conveyed ... formatting is secondary
Do any of you use gitlab ci for your continuous integration?
@Ocramius Having everything in one file, doesn't have to be a .phar.
@kelunik still not clear what the use-case is
@Orangepill I don't get your mean
22:14
@sajad how do you access information that is stored in your session?
@Orangepill ah, in the a php file, I need to use that session for redirecting
@Ocramius The use case is "I don't know how to use heredocs but I found this nifty, esoteric function call in the manual that lets me get raw data from the same file as my script, so I'll become a l33t h4x0rz!"
@Ghedipunk now we're talking
@Ghedipunk I would use single quotes instead of heredoc if I were to include arbitrary binary things.
@kelunik That's what nowdocs are for. (At least I think that's what the manual calls them... Been a while since I've looked at it.)
22:18
that class is instantiated statically, meaning that when they mean "implement", they mean edit that file o_O
huh?
@ircmaxell O_0 ...Ummm... Someone doesn't quite get OO paradigms...
@ircmaxell too drunk to give a damn, still, nice :P
so yeah, no real extension endpoint for consumers
22:23
You can hack class loader and load your class
@zerkms if you're dumb enough, yeah
@Ocramius I'm not editing library files, meaning that's useless to me
@ircmaxell yes, agree.
@zerkms No immediate red flags, except the fact that they're not core PPAs for your distro... Still, I'm no security expert, and my default is to distrust non-core projects.
@Ghedipunk that's true, but distro's one are obsolete :-S
and annoyed of random segfaults
22:26
There's always building from source...
...At the very least, you can tune PHP to your own project's needs when you build from source.
I'm maintaining too many packages locally already, not wish to build even php :-S
@Orangepill actually here is my structure.
@Sajad you send it via ajax
@ircmaxell do you think they intend for you to extend that class?
@Orangepill no, because it's hard-coded into the application logic
22:28
@Orangepill No, everything is static there.
@ircmaxell What are the features you're looking for?
@zerkms something like this? $.post('pageB.php', {variable: url});
yep
@kelunik I want to be able to do feature flagging, boolean status as well as per-user, per-group and random
@zerkms but I need to session !! not a php variable
@Sajad I'm not sure what that means
22:30
@Sajad You can not access the session from Javascript. It MUST go through your server and through PHP.
@zerkms oh, someone gives me a answer, that is like what you said, I got it now, tnx
@Ghedipunk yes! this is right
And that capitalized MUST is the same as the RFC MUST defined in RFC 2119: ietf.org/rfc/rfc2119.txt
@Ghedipunk that's a MUST as defined "you would be a moron to work around this issue", not "there are technical limitations that make it impossible"
One can always change their session cookie to hijack someone else's session, where the client-side representation of the URI is already defined in the session, thus moronically working around the issue...
@Ghedipunk btw, I just found that the maintainer of those PPAs actually is one of the maintainers of the official ubuntu php packages
which adds some points I suppose
22:59
sup all
@ircmaxell As per-user and per-group would have to be implemented for every project separately, the amount implemented in a library would be pretty small, no?
how can I fix its syntax error? $current_url = isset($_POST['current_url']) ? $_POST['current_url']:;
Add something after the :
but I want it be empty!
23:10
@Ghedipunk tnx
'' is empty. There's a huge difference between empty and missing a required token.
null is also a good alternative to indicate that a value is empty.
@NikiC github.com/php/php-src/pull/1513 do you think this is appropriate for RC3?
@Ghedipunk If I use NULL for a variable, this condition will be true ? if(empty($var)){}
The following things are considered to be empty:

"" (an empty string)
0 (0 as an integer)
0.0 (0 as a float)
"0" (0 as a string)
NULL
FALSE
array() (an empty array)
$var; (a variable declared, but without a value)
23:15
@samayo great! tnx
@Ghedipunk tnx ;-)
$ php -a
Interactive shell

php > $var = null;
php > if (empty($var)) {
php {     echo 'Null is empty!';
php { }
Null is empty!
@Ghedipunk like
@Ghedipunk you should also assume that sessions are HTTPS only. I think this is also OWASP standard.
Hai again, is this an effective way to create a hashtag functionality? w3lessons.info/2013/11/18/…
Hey there. I'm getting a weird forbidden error.

"You don't have permission to access /getControle/produit/getControle/produit/getControle/produit/getControle
/produit/produit/getControle/produit/getControle/produit/getControle/produit/produit/getControle/produit
/getControle/produit/getControle/produit/produit/getControle/produit/getControle [a few more hundred repetitions of this] /produit/getControle/produit/getControle/produit/getControle/produit/produit/getControle/produit
/getControle/produit/getControle/produit/produit/getControle/produit/getControle/produit/getControle
23:28
which means: if your website is accessed via HTTP, all cookies must be deleted and the website should not contain any client-side scripts at all (that is all javascript must be effectively filtered out). only via HTTPS any state mechanism should be accepted server-site and client side scripts be hosted.
@hakre It is the OWASP standard, yes. As an open source developer, though, especially with my target audience being PHP developers with its low barriers for entry, I can't assume that my code will always run on properly secured systems.
which is why non HTTPS traffic needs not to have client side scripts nor server-side state (at least for the PHP application).
that is less attack surface for low entry barriers on less properly secured systems (self-hosted PHP application).
@hakre The session ID cookie should have the Secure flag set, as well.
^^ the problem seems to be server side as firebug seems to tell me that the accessed url really is /getControle/produit, as intended, but php throws a forbidden with a very long url
for example. also you should question if the self-hosted your PHP application makes sense for your provided HTTPS detection (anything than cookie is less trivial).
23:36
@kelunik not really, there are more things to keep track of other than session vars.
@ircmaxell any examples?
Ab testing, random rollout, etc

« first day (1794 days earlier)      last day (3380 days later) »