« first day (2906 days earlier)      last day (2267 days later) » 

00:01
@benlevywebdesign I don't think it would be, no, but it depends on the use case.
true
I'll think about it
Wes
Wes
00:14
i still could not do it
omg
01:08
@benlevywebdesign I have been trying to do this for years.
I also wanted to note the time of login and logout/leave
You people keep telling me to learn Ajax.
I keep watching Deadpool trying to understand Francis.
@benlevywebdesign something about real time tracking or figuring out tab close..
I'm not very sure, I'm not an expert...or even a novice yet.
I already do track login date
is just php
Our system uses LDAP authentication, and there are some features of it that can be used to track login. Right now I have something in there to track failed logins, but I'm considering turning that off because I haven't needed it for a while. It was nice when I was trying to configure it to use LDAPS because I could get detailed error messages. Though, it is pretty funny to receive like five emails from unsuccessful logins, even funnier when it's me...
Whats that for?
01:22
Which?
I'm just trying to track a user login for an employee who really thinks they need access to one section that requires a log in to see how much they actually log in
There's probably a library that can do it
I could configure my setup to track every login but fuck that... however we log entries when a user makes changes to a webpage, and I've written an SQL script to generate a report of recent active users, and what pages they modified
This person is an "office admin" among other things and the page they want to access should really only be access by the manager of the place not the admin in my eyes
What do you mean page they modified like the code or whats on the page
I did that mainly for our marketing team so they could get an idea of who is actively updating their pages, so when we switch to a new web platform, we have an idea of who will still need access
@benlevywebdesign it's a custom built CMS by a local vendor. So when a user modifies a page, it gets logged to the database. It's primarily used as a versioning system in the CMS so we can revert a change if it's bad.
But because it's logged in the database, I can pull some nifty data :)
Mind you, I administrate a public college website, which has roughly over 1000 pages...
I do this to track edits on employee info
01:32
Well, "pages," but some of those are dynamically generated and are routed to through the site... but Siteimprove lists over 1000 pages in our site
and this for new added employees
I don't add the employees manually, I have a php script that will auto-import them, and it's scheduled to run like every hour or so
It syncs with our Active Directory, and pulls users from a couple OUs I have specified
ah
from outlook
It's nice cause if an employee is terminated and their AD account is deactivated, the script will pick that up and automatically deactivate their web access
No, Active Directory
Outlook uses Active Directory, typically, but they're not the same
oh this is not for web access this is employee information(profile on the employee)
01:38
But you were talking about tracking a user logging in?
2 different things so yes
I'm excited about the new web platform though, it'll be sweet
Built in Java though :( but it does a lot of stuff
It does allow php code to be added into pages, but it has to be simple php, like procedural junk
God, thinking about all the shit I have to do before the end of the year... T_T
wow looking back at my imgur uploads is funny
so much random stuff or odd screenshots
besides this. I did this in illustrator and its still looks cool
Could anyone here help me to install a mail server in ubuntu?
I really need to do this, But I've been stuck in the configuration phase for a long time

https://askubuntu.com/questions/1079560/dovecot-no-authenticationfailed-authentication-failed
what did you try?
01:52
@benlevywebdesign Loo at this: askubuntu.com/questions/1079560/…
I'm no help but maybe you think about the problem a different way and that might help dunno
This is a php chat room
I have tried everything you might think but it doesn't work
+ I don't know anyone expert to ask about this problem
I'm confused ):
02:16
Anyone used ebay sdk?
 
1 hour later…
03:19
Is it safe to wrote a C "long" to a zend_long?
03:50
mornings
I havn't composer dump-auto command!
my Composer version 1.7.2
 
3 hours later…
06:29
morns
Wes
Wes
@PHPFan why you do that to yourself?
06:47
Hi.
I am trying to install "pthread". https://github.com/krakjoe/pthreads
I am following the guide, but got a confused point
http://joxi.net/BA0LK1ecJKV08A
What is "make", could you please give me a link?
07:21
@112Legion are you on windows?
07:38
@rtheunissen Unubtu 18.04
Have you run ./configure?
yes it has created
Makefile.fragments
Makefile.global
Makefile.objects
What happens when you run make?
make: *** No targets specified and no makefile found. Stop.
the all bash command
https://pastebin.com/GmcFJtpG
08:21
hello
o/
@rtheunissen I don't know any archs where sizeof(long) > sizeof(zend_long), so yes
@112Legion then your configure failed
@rtheunissen what should I do?
What is your output for configure? (last few lines)
Oh wait I see there's a pastebin
mornin
08:29
@112Legion configure: error: pthreads requires ZTS, please re-compile PHP with ZTS enabled
Thanks @bwoebi
@rtheunissen Oh. I haven't noticed that. Thanks, I will try to google )
Hello all could anyone have a time to see my question please?
Hi @rtheunissen
Wes
Wes
btw, is it possible to compile the apache handler with --disable-zts ? (mswin)
08:50
It's a bit over my head but my concern is that it's non-standard.
 
2 hours later…
10:44
@rtheunissen I don't get that article. I thought the whole point of dec64 was to avoid the surprises that occur when digits in base10 aren't exactly expressable in base2.
Nothing to worry about: nobody has. When ever you face any kind of error keep in mind that first thing you can do is to go to official documentation and confirm use of command. Instead you should call [composer dump-autoload](https://getcomposer.org/doc/03-cli.md#dump-autoload-dumpautoload-) (composer dump autoload|composer du). Two in parenthesis are alias.

Morning.
 
2 hours later…
12:57
@tereško around?
I was talking to one of the teammates, he said, why did you restrict robots.txt file? He said, you can simply remove the sitemap path from that file (to avoid people know your sitemap files)
And then, add your sitemap link to google using google console
that might work
"frontend development" is not my specialty
so there isn't much I can help you with in that area
I see. Just do you know why I insist on removing robots.txt file accessing-limitations ?
Because, every day I'm getting an error in the apache error-log file like this:
> [Sun Sep 30 14:51:02.687122 2018] [access_compat:error] [pid 16780] [client 216.244.66.237:53222] AH01797: client denied by server configuration: /var/www/html/myweb/robots.txt
... you also get errors with wp-install.php not found
13:03
I think search engine crawlers try to crawl us but we don't let them
@tereško what? what's that file? did you check the apache error-log file?
it is associated with Wordpress installation
ah .. we don't have any wordpress project on the server
there are thousands of bots checking every site in the world for vulnerable sites
because accessing an address, the bot does not know whether you have wordpress or not
I see .. interesting
Wes
Wes
13:24
have you ever seen LED light bulbs about the size of the old incandescent light bulbs?
the ones i see in the stores are gigantic, like 3 times that size
user10382642
2
Q: Display an image in a fixed position when hovering over a row of a table generated with php from a database query

ArturoI want to show an image when hovering over a table row. I want to know how to pass an argument to the showCard function for building the link dynamically with link = "http..." + name. And why does the function get a this argument when there's nothing in the function declaration? <!DOCTYPE html> <...

14:51
Hey everybody,

i got a little confusing Laravel problem over here.
I builded up an api for local usage only. Therefor i registered the createFreshapitoken middleware which should handle the authorization for local request.

Everything is working fine.
than i want to upgrade to laravel 5.6.3 (from 5.6.29) and the api always return me "unauthroized..."

can somebody help ?
15:06
If you worked with git you can check differences and code changes between latest commit before update and first commit after update. If you don't work with git, you should.
15:22
that does not help to me because the error needs to be in the laravel update or at least related to the code but they have not commited anything in the changelog
i can easiyl downgrad to the version where it is working but i need to update to the latest.
in both cases the same cookies and headers got submitted to the api
Hard to say because it is clearly from some of code changes after framework update.
Copy/remember versions of packages in composer.json before and after update. Higher version of framework can (and probably does) update version of some of dependenc(y|ies). Maybe error is not because of version of framework but rather of changed version of some dependency.
I'm currently at debugging the authentication lib.
Just in the docs there is nothing that i did wrong.

https://laravel.com/docs/5.7/passport#consuming-your-api-with-javascript
15:57
@Traxstar You have followed doc page about upgrading?
Morngins
16:17
\o
ping @kelunik
What magic is / does enableCrypto() in amp socket?
Is it possible to allow it to do https or probably a better question is there a simple example? :P
Evenin 11
Hola @Sean
Eve.
16:26
@Tpojka 1 there was no upgrade docs from 5.6.29 to 5.6.30. there wasnt even a changelog
Read here. There is one change.
 
1 hour later…
17:37
hello everyone
18:07
afternoon
18:18
ello
18:33
Using Symfony 4, I'm trying to define a custom controller for HTTP 404 errors
I'm following the documentation page: symfony.com/doc/current/controller/error_pages.html
but all I get is: RuntimeException: Invalid service "App\Controller\CustomExceptionController": class "App\Controller\CustomExceptionController" does not exist.
Can someone help?
@Jocelyn it sounds like class App\Controller\CustomExceptionController does not exist or can't be found. Have you checked for silly typos in the file name?
Or for a lack of namespace declaration in that file?
the file exists, and so does the class in the file
namespace App\Controller; (same as the other controllers)
my other controllers work fine
I'm a beginner with Symfony, so I may have done a stupid error somewhere...but I'm unable to find the issue so far
you can debug this by stepping through the composer code for loading classes.
19:10
I posted the full error messages here: gist.github.com/J0celyn/74383b047334e0fbbfcebec8eddf948f
 
1 hour later…
Wes
Wes
20:12
can i define an arbitrary handler in internals for
AnyClassEvenThoseIDoNotOwn::$readStaticField ?
also hi
Wes
Wes
i think i know how to overload the handler. if i overload the handler for a class with my own, which would call the old handler if my own is unable to fulfill the request, will that work?
20:35
handlers are just function pointers, right?
@Wes no
I mean you can overwrite the relevant opcodes, but apart from that, no
Wes
Wes
sorry i didn't mean all at all time. like, if i wanted to register a static property getter on Closure, how should i do it properly?
@Wes you can't ^^
To clarify, those handlers don't exist
@Wes Those are not for static properties
Wes
Wes
20:43
can't i just set my own, and fallback to this if my own cannot fulfill the request
ah
so where is callStatic for example?
@Wes get_static_method handler
Wes
Wes
i might do it with an object property... it's a proof of concept anyway
$c = function(int $a = 123, string $b = "foo"){};

$c($c->defaults[0], "baz"); // $c(123, "baz");

i hoped i could do

$c($c::$defaults[0], "baz");

@NikiC
@Wes For object properties, the way to do it would be to hijack the create_object handler and there overwrite the object handlers with your own handlers
Wes
Wes
you might like the idea
that's to skip default arguments, pretty much
@Wes What could possibly have given you that idea?
It's pretty weird to tie that to closures, given how it really doesn't have anything to do with closures
Wes
Wes
20:50
in "other languages" default arguments are more easily accessible than php's instance all the reflection things thing
that would work for me, because i can do (using symbola, remember what it is?)
($object->method)::$defaults[0]
ofc it works for me but it's also what should be the syntax in php, imo. without symbola it would be
Closure::fromCallable([$object, "method"])::$defaults[0]
anyway, will give a try at it tomorrow. i have no idea where the default arguments are stored... will need to dig quite a lot :B
@NikiC these bugs you're uncovering are fun :-P
@NikiC On a more serious note, zend_property_info.name is always mangled?
21:16
Hey SE, I got a question for you. I'm trying to protect my cookie from tampering so I have a tag that I use as a key to try to see if someone has "stolen" the cookie to try and hijack a logged in session.
This is what I use to generate it.
$remoteadr = $this->_SERVER["REMOTE_ADDR"];
$serverprt = $this->_SERVER["SERVER_PORT"];
$remoteagnt = $this->_SERVER["HTTP_USER_AGENT"];
$serverhost = $this->_SERVER["HTTP_HOST"];
Apparently, if a user switches to another wifi - depending on the wifi - the IP Address changes.
So I'm wondering if I can check the key on some other component.
@bwoebi yeah (public props aren't but it's still safe to just always call unmangle)
@bwoebi For some definitions of "fun" :P
Is transmitting the cookie key on HTTPS, enough? I would assume it's not. Because the file is still created and it's a key that could be hijacked.
@NikiC okay, needs updates in quite a bunch of places then ...
@NikiC well, on the one hand it's annoying that there are still bugs, on the other hand it's fun to try to understand the bugs and think of fixes
Wes
Wes
21:23
i might do that with preproc
@JustinKaz why are you not including a "signature" with the payload in your cookies?
instead of this insane fuckery
@NikiC where a property is redeclared in a child class, which IIRC shares the offset ... uh seriously? Is there any reason why we need to retain a property in the child properties list if the parent already has it?!
@bwoebi it might have different visibility
Ah right
{"info": {"name": "The Universe Security Device ID","type": "Soft Token","generator": "egt.universe.secure","id":"1.0.14.7"},"key":{"sha512":"3186c223-bbfc-4321-a510-‌​0c2dde08e79b-ae092c9a9d254a3c19c747de948b32694beccea3d2fe9c9f851067b08aaca74d0789‌​6c0f731e65a6526c24e5561ac5170de74be90c361ba42e6a8422b9a7659b"},"tag":{"sha512":"7‌​dab861c39cf38590bcd5d63b44ce02ad547b592edf5e2e683b4c0a464a9d856805bbb7e7aadbaf4a3‌​5a56db6166334e0a7a704392f955194597a829c6e76abe"}}
21:25
ugh
@tereško That's the actual cookie
The tag is salted and hashed before stored
@tereško Is it truely that bad?
I'm just gonna go and sleep now
the "id" is actually more of a version, no IP address is physically recorded
@tereško So it's that bad! :D :D :D
GN!
It's just a json object that I can extend. My thoughts are when I think of CSRM attack prevention that it may extend that cookie or provide another.
21:33
@JustinKaz csrf?
Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data, since the attacker has no way to see the response to the forged request.
I stole that from the web lol
You said CSRM :P
oh lol
I was wondering if you meant CSRF
Yeah... let me make up an acronym... again.
Yep
As of now, I feel like my cookie is secure but if a user has a laptop. They are going to hate me forever.
Please, Log in, again, and again, and again.
21:36
There are two quality sources on web application security I'll link you to when I get to my computer, if you haven't read them already
Cool!
I think the Chat is broken, it occasionally scrolls all the way up to white and I have to wait for the chat to come all the way back down... lol
Top 10 OWASP on the surface is a general overview of threats to look out for, but they include links to additional resources that have more information
@NikiC there's no shorthand function/macro giving me a char* from a property name directly? Can't find one by a quick search
there's just zend_unmangle_property_name() which thinks it necessary to give me also the class name
Otherwise I'd create a zend_always_inline char* zend_get_mangled_property_name(zend_string *mangled_prop) { char *class_name, *prop_name; zend_unmangle_property_name(mangled_prop, class_name, prop_name); return prop_name; }
So what's with the "regenerating session id" after a successful login?
21:51
with regards to...?
A few security websites say to regenerate the PHP session id after a successful login.
I'm choosing to forgo the entire PHP session system and utilize my own database hybrid.
Because I can "secure" the server more than I can "secure" the client.
That's the theory.
Oh yes - pure SSL and Secure Cookies all the way.
but there's a part about regenerating session id
I don't believe in HTTP anymore. Even my static pages - stupidly - still get served from a HTTPS - for no other reason but just so It's easy to upgrade later.
Why every 5 minutes?
21:56
paragonie.com/blog/2015/04/… (something else regarding authentication)
@JustinKaz the website I manage at work is HTTPS all the way. There's a rule in the web server to redirect traffic to HTTPS. However, this server doesn't have an HSTS set up... something I probably should do... or maybe it does? I know I set it up for one server that we'll be switching to sometime this year or next year, but can't remember if I did the same for our production server...
But, our athletics site is served over HTTP because the domain is different than our wildcard cert domain. I've thought about switching it to Let's Encrypt, but haven't gotten around to implementing it because there are some parts I'm not clear on.
seeing an A+ on SSL Labs though... very few things compare to how sweet it feels
Yep. It's the first check performed. Are you secure? No? Well, go get secure... or else.
LOL
There is a lot to think about when regarding to security.
I think I'm going to need to facilitate a way to "update the device id" - where the device ID becomes something that's updated at the beginning of every page call or something.
I also need to find a clean - and hopefully extremely low cost way - to implement second factor authentication.
I think the scariest part of a auth system is the back-door feature "reset my password"
UGGGGGGGGGGG
security became a topic of interest for me when I had to increase the security of our website/server based on the report from some penetration testing performed by a security firm. I read a lot to try and understand some of what I was doing, but I'm still incredibly far off. But I enjoy reading about it now, and considering looking for another job in security, either I'll need to read a lot more or I'll have to find an entry position to get started...
22:12
When my app get's big -> I'm hiring security peps for sure.
But until than, it's me... so I'm going to do all that I can do to be secure.
Wes
Wes
major screwup. i was editing files in vendor/ because i couldn't be arsed. did quite a lot of changes, then forgot about it, and now i just did composer update
@JustinKaz there's also pentesting sites
@Wes oh no
and I'm guessing because it's vendor, it's not tracked by git
Wes
Wes
correct
eh. nothing i cannot rewrite. just annoyed by the wasted time
If I had a billion dollars everytime I did something like that @Wes - I'd have 2!
Wes
Wes
lol. it's not the first time i do that, but this time is a bit more catastrophic. 20 ish files i just don't have the strength to rewrite
22:24
Why so @Wes ?
You are messing with C of core PHP I'd like to think you would clone repo (in like less then 25 seconds) and use your own since looking at those need for changes you are not particulary interested in original repo code version.
I wonder if people keep a separate, private git repo of their vendor folder?
or would that make composer freak out?
You are messing with C of core PHP . - meaning you know lot if it but still not cloning some external repo for own use.
@Wes is your goal with your CSS parser to be part of PHP, or are you writing a PHP library for CSS parsing?
Wes
Wes
nope, it was some php_codesniffer sniffs
blah, I have to get intimately familiar with Apache and .htaccess at some point tonight, not looking forward to it, but I need to make some progress on my dad's website
Wes
Wes
22:27
they checked the right whitespace after { } ( ) etc
@Tiffany Thanks for links above. Bookmarked.
Wes
Wes
@Tiffany such a thing has basically no use. of course is not useful to have it in php :B
can do static analysis, minification, preprocessing
and that's just about it
22:44
oh geez, my sister owes me 1300 dollars... x_X finally updated my bookkeeping
Wes
Wes
how is she tho? i remember she had health problems
I helped her buy a car, the loan is in my name and I have it set to deduct from my paycheck. She was keeping up on paying me back, but she lost one of her jobs last year and so it made it harder for her
Wes
Wes
:(
Part of me just wants to let her have it, but the other part of me feels that I need to hold her accountable, that I think it is good for her to be held accountable. I'm not upset that she hasn't been paying me, she's had a lot of trouble this year.
Then again, I don't know how bad her depression is currently, it may just make her depression worse. 😒 Guilt like that used to do it to me. I've reached a point though, that I'd rather be held accountable to something.
Wes
Wes
23:03
yeah give her time. it's family :P unless you actually need the money yourself i wouldn't ask
!!> var_dump($arr["not here"] ?? null === null);
[ 7.1.0 - 7.3.0rc2 ] bool(true)
[ 5.6.38 ] Parse error: syntax error, unexpected '?' in /in/tDL1N on line 1 <br/><i>Process exited with code <b title="Generic Error">255</b>.</i>
Wes
Wes
noooooooooo
@$arr["not here"] === null it is then
@Wes yeah, I don't need the money. I just let her know what it's up to, but there's no pressure on when she pays me back. I figure she'd at least like to know.
Wes
Wes
if you let her know you counted the money you are putting pressure on her for sure
i know every single digit of debt i have, i am sure she already knows how much she owes you too
@Wes I guess I need to emphasize that I'm patient
I haven't said anything to her all year though
23:20
I think iMessage relies on clients for maintaining who is in and out of group texts
manually editing the db seems to bypass being kicked
should I report to apple?

« first day (2906 days earlier)      last day (2267 days later) »