« first day (3603 days earlier)      last day (1352 days later) » 

12:00 AM
Shouldn't array_shift/unshift use $queue instead of $stack...?
Shouldn't array_shift/unshift use $queue instead of $stack...?
 
cmb
@CDoc Nope, that was nonsense (well, actually C behavior, but not PHP). Sorry!
 
@Girgias you keep using the wrong "your" :(
 
I'm tired :(
 
I feel you there... first day of contract work triaging a bunch of wordpress sites on a compromised server... feels like an exercise in futility
 
@Tiffany as long as you don't mix up "you're in", "your inn" and "urine" it's all good
 
12:07 AM
ew
 
Should I try to convert comment-based union types to part of the function signature while I'm in here, or separate PR?
 
if it's possible to keep the jobs properly logically separate then do so, otherwise sod it
(imho)
 
Aside from a guaranteed git merge collision they're fairly unrelated.
Also, TIL: You can't use $ in a Git commit message. It just strips the value out of the string.
cries
 
@Crell You can't do some of them
 
regex?
 
12:10 AM
At least not currently
 
@Crell That's bullshit … did you maybe use double quotes on the cmd line with bash?
 
@Crell isn't that because of phpdoc?
 
Yeah, doublequotes. :-(
 
i think that's the old svn revision counting system thingy
oh lol
 
@Crell Just use single quotes like you would with PHP
 
12:12 AM
@Girgias No, but some of them can be, from the looks of it.
Now I have to remember WTF I even did...
 
heh, I have the opposite problem where I am forever trying to use single quotes in cmd
 
@DaveRandom true programmers just use heredoc ... right?
 
You can do IIRC string|int, string|class, string|array, int|float, possibly array|object ? Will all the nullable variants
 
@bwoebi prefer to win+R for every individual command
 
@DaveRandom because it's obviosuly easier to not have a proper cwd?
 
12:16 AM
yeh, working directories are for pussies
 
@Crell i have two largish open PRs which do the same. They take care most of the phpdoc types which are currently possible to convert to native type declaration.
 
ugh, seriously though the single biggest thing I wish that cmd had was a sh-style VAR1=foo VAR2=bar cmd... syntax
I mean there are a lot of things I wish it had, mostly to have stopped existing a long time ago and just been replaced with a proper shell, it would have been perfectly possible ages ago
 
@DaveRandom I usually just use the wsl bash and I'm done - in the windows terminal
 
Yeh it's not portable though, not in the scope that I need I.e. arbitrary machines in the wild
 
@MateKocsis Oh. Lovely. We'll probably bump into each other. Sorry. :-)
If anyone wants to criticize my naming decisions: github.com/php/php-src/pull/6046
 
12:22 AM
the best and most consistently portable scripting engine for Windows is still vbscript :-(
 
@DaveRandom not even powershell?
 
I got my start in DOS Batch files...
 
@Crell I feel the urge for an exorcism now...
 
Sod PowerShell, unintelligible garbage, it's not possible to wrote nice looking code with it (read: I have entirely failed to...) and it's so bloody fragile, the number of times I've had cmdlets fail to load on a handful of machines for no obvious reason
It's absolutely nuts, all I wanted was for them to fix some of the idiosyncrasies of cmd, the insane quoting behaviour and such, could all be nicely controlled by flags, loads of precedent for it... and they gave us that piece of broken crap instead
 
ewww
 
12:30 AM
github.com/php/doc-en/pull/136 and github.com/php/doc-en/pull/134 are both stalled on needing feedback on how to describe the error conditions of functions with ill-defined error conditions. sigh Anyone want to weigh in or advise?
 
12:45 AM
What they hey? The stub PR is failing with errors that are entirely unrelated to the PR contents...
 
1:36 AM
@DaveRandom pffft, you just can't appreciate it :P
 
Ah wait so is it some kind of really long lived practical joke that I'm just not party to? Like The Game or something?
Btw I just lost the game
 
1:58 AM
I completely abstain from that
I can choose to be a participant, and so I choose not :P (i.e. I don't care about it)
 
 
1 hour later…
3:22 AM
make compile error, rasid by sqlite3.c ・ Compile Failure ・ #80023
 
3:53 AM
@Sara Can you explain a bit more specifically what you mean by this?
> In my opinion, this is an 8.1 feature unless you can convince me that 8.0 will be materially harmed by not having it.
As a question to help frame your response, is this 9k line feature going into 8.1 any less harmful than it going into 8.0? I don't think so, btw. If it goes in now or later we're going to hit the same bugs, just later. And no, I do not mean that they will be found in nightly testing, prereleases, etc; I fully expect the real bugs to come out when we hit users.
So what do you mean by material harm?
Also, would your opinion have been any different if we had just merged it with Dmitry dissent a month or more ago? What do you care about here?
 
4:11 AM
I don't want to be a victim of the tyranny of the minority, which is what this will be if it doesn't make it into 8.0. Literally one person, Dmitry, has kept this out of the core for months. In the latest round he was unhappy with performance, but the overhead was so minimal that even when trying to worst-case benchmark it that the variance in runtime far outweighs the overhead. It's not measurable. So we specialized the opcodes. I still don't know if he'll be happy.
But... if that's how it goes, that's how it goes, I guess. I still want to do everything I can to get it in.
 
4:24 AM
Also, I want to point out that by not having this feature that most extensions wanting this functionality will use zend_execute_ex, which can and does segfault. That's pretty harmful, and is the whole reason we are doing this.
The alternatives are to use opcode handlers, which are more difficult so from time to time we get segfaults there too.
I'm trying to convey that this PR is in the business of reducing segfaults.
 
Duplication of info about inherited socket after pool removing ・ FPM related ・ #80024
 
4:55 AM
@Tiffany yeah we have one of those too (small child). Between the cats and the child im not sure who's more destructive.
 
 
1 hour later…
6:12 AM
Good morning.
\o
 
mornings
 
6:42 AM
Leslierourn ・ *General Issues ・ #80025
 
cmb
7:05 AM
@Crell The failures look related to the PR. :)
 
7:23 AM
Hello guys
can anyone tell me what is the best tool for sast testing for php application
open source tool
 
7:37 AM
@Maximious Best one I know is ripstech.com/product/tour. But while I use static analysis a lot in my development, I do not think that static analysis is enough for security. It is an important tool to be used during security audits, of course.
 
@SebastianBergmann thanks Sebastian for reply :)
 
@Maximious It's not open source, though.
Maybe some day Psalm's security analysis feature(s) catch up with RIPS, but not yet.
 
I will definately check ripstech . it's alright with me if ripstech is not open source
 
ok . I am checking psalm
 
7:42 AM
@LeviMorrison yes
But you can use USE_TRACKED_ALLOC=1 to ignore those leaks under LeakSanitizer and valgrind
And exceptions no longer leak since 7.4, and exit doesn't leak since 8.0
 
 
2 hours later…
morns
 
 
2 hours later…
11:41 AM
@cmb what is that XML feed with php releases again?
 
cmb
the announcements are php.net/feed.atom
but that's not what @Ocramius is looking for
 
i know - maybe it's helfpul though
 
cmb
I don't think we have anything about the CVEs
maybe wiki.php.net/cve#allocated is helpful as well
 
yeah, that's more like... human-friendly stuff
I'm looking for something that contains affected version numbers :D
 
@Ocramius Maybe we have one in YAML :P
 
11:47 AM
FUCK OFF :P
 
cmb
11:57 AM
@Ocramius, if you want to see CVE and PHP version which fixed it, than check the changelog.
 
Morning
 
@cmb problem is the range of fixes. Multiple PHP versions are released with security fixes
Perhaps I could indeed use the changelog, parse CVE ids out, then de-duplicate based on that? hmm...
 
cmb
Yep, that's what I meant. :)
 
I feel like @Ocramius should write some ansible ... as a cure from his YAML hostility
 
if the application implements good validation, i.e. no arbitrary keys, ranges for every valid input, then yaml isn't so bad.
essentially what symfony does with the configuration config definition abstraction
 
12:20 PM
@Ocramius I take it you prefer NEON over YAML, good sir?
 
1:01 PM
I want to add plugins from market place in github
I am trying to install Synopsys Detect but it says
Copy and paste the following snippet into your .yml file. for installation
can anyone knows what is the meaning of it
 
1:26 PM
...yaml...
 
1:38 PM
Hi @Tiffany how are you?
 
pretty good, yourself?
 
Great
 
:)
 
Any luck with the job search?
 
a little, started some contract work yesterday
 
1:40 PM
programming?
 
not yet so far, but hopefully will lead up to that
 
I am trying to find a link for you but I have lost it
Anyway, I think you would love working as a technical writer
try looking for one
and thank me later
 
I have tried looking, but every single one I've seen wants an English degree
 
Can you start as an intern? or find out if they accept the Cambridge English exam
Here @Tiffany old.reddit.com/r/ADHD/comments/gjjd4l/… I can't stress enough how true this is
 
yeah, I've read similar stuff
I'm familiar with it
 
1:50 PM
I used to go to work just so I can get paid and pay the bill, now I'm almost a workaholic :)
Anyway, GL.
 
thanks
 
Hello People
 
hello
 
@NikiC This will hide anything that is emalloc'd, then?
Or arena allocated?
 
2:06 PM
@LeviMorrison It will hide all ZMM leaks on unclean shutdown
 
So I should only set this for tests that intentionally do unclean shutdown to avoid masking real bugs.
 
You'd usually set it for all tests
 
Won't that mask real leaks though?
 
It only masks leaks on unclean shutdown, so no
 
Gotcha, thanks.
Does anyone know why trigger_error isn't allowed to generate internal error types? It'd be useful for testing when I want to ensure something happens on E_ERROR, for instance.
 
3:03 PM
I'm writing a quick blog post for Platform.sh on PHP 8, and want to include a brief attributes example. With the syntax vote, though, I don't know what to use. Based on the current vote, it seems likely that it's going to end up with the Rust style #[]. Do you think it's safe for me to use that as the example, with appropriate caveats? (Although the post may not go out until after next Wednesday anyway...)
 
@Crell the patch will not be in beta 3 however, so while the new syntax may be accepted it can only be used in RC1
so caveats make sense
the result is not in favor of #[] in such a way that we can merge the patch early I believe
 
Agreed on the second, definitely.
"The syntax is undergoing some last-minute changes as we write this so may change by the time it's released. The most likely syntax (which won't be included until the RC1 release) is borrowed from Rust:"

Does that seem reasonably safe and bet-hedgy?
 
I would delay the blogpost, personally.
 
custom ob_start with ob_gzhandler resending headers and generating corrupted ou ・ HTTP related ・ #80026
 
3:31 PM
@beberlei I think the result is going to be in favour of merging earlier to get it in beta3.
Candidate '#[Attr]': 29 → 2 4 5 15 18 19 20 22 25 26 27 28 29 30 31 32 34 35 39 40 41 42 43 47 52 55 56 58 59
Candidate '@[Attr]': 12 → 3 7 11 12 13 16 17 23 36 37 53 57
Candidate '@@Attr': 9 → 1 24 33 38 44 45 49 50 54
Candidate '<<>>': 5 → 0 8 14 46 51
Candidate '@{Attr}': 4 → 6 9 10 21
Candidate '@:Attr': 1 → 48
If even only two from all the non-#[] votes transfer to #[] at some point, #[] wins.
The only other technical win could be @[]
 
i was wondering what happen sif you eliminate all choices based on the STV rules until only two are left
 
Hello Everyone
Can someone assist me If an API(thrird party) is taking long time to response, can I add a exception that If any API taking longer than expected time(say 5 minutes or more) then the API request is killed and the processing continue on the next step.
 
Tally:
Candidate '#[Attr]': 37 → 2 4 5 15 18 19 20 22 25 26 27 28 29 30 31 32 34 35 39 40 41 42 43 47 52 55 56 58 59 9 10 8 14 21 44 49 50
Candidate '@[Attr]': 22 → 3 7 11 12 13 16 17 23 36 37 53 57 6 46 51 24 33 38 45 54 48 0
 
I think that a pretty clear enough win for an early merge
 
i am reluctant to test the wrath of internals mailing list again ;-)
 
3:44 PM
@beberlei Just found another benefit of using #[ ] over << >> - much easier to write in HTML :-)
 
&lt;&lt;Right&gt;&gt;
 
I'm just writing two php 8 talks, and they're going to use #[] :-)
 
It wouldn't change anything, but the secondary vote should have been simple majority. As per the voting RFC
 
a simple majority only works with two choices
It's a terrible way of selecting between multiple options.
 
It may be, but there should a RFC to propose allowing STV or whatever. Just saying that currently, that option doesn't exist in the voting RFC
 
3:50 PM
there is a vote in THIS SAME RFC to ask about it. Which is the primary vote requiring ⅔rds
 
@pmmaga shh! I've got 10 bucks on someone emailing internals announcing that this whole thing has been ILLEGAL!!1111 and so totally non-binding. :P
 
Yes which is also according to the rules. The rules also state that any secondary vote should be simple majority. And if we want to allow other kinds of votes, that should make it to the voting rfc
@salathe where can I bet on it? :D
 
To be honest, I'd also argue that deciding on the attributes syntax is really NOT a secondary vote... but only under my breath and not in public.
 
FWIW I did mention this on internals already
 
But yeah, "we" should really add an amendment to the voting RFC to "officially" allow STV for multiple option votes.
 
3:55 PM
But maybe in 6 months or so to not give anyone ideas :D
 
@SebastianBergmann Sebastian pls
 
@bwoebi I think it's clear enough as well, but the change risk of attributes is pretty low, so it's fine letting it be an RC1 merge.
@salathe For that matter, we should have a voting doodle which supports STV natively.
 
@salathe I do agree with that. I will see what I can do about that.
 
@Sara That would be lovely. I swear I struggle waaaay more than is reasonable on these many-polls RFCs.
 
I tried looking for such a doodle. Doesn't exist. And that plugin syntax is TERRIBLE. I don't want to get near it.
 
3:59 PM
Also also, it'd be nice if the results were hidden prior to end of voting, but that might get more pushback.
@Derick hahahahaah
 
That doesn't stop us from setting up a page for them though.
 
I'd also like to see an optional comment section (if someone wishes to justify their vote)
 
That's about the reaction I'd expect.
 
4:33 PM
@Sara yeah, drag and drop into preferred order would be great.
 
@Sara Change risk is low, but tooling is waiting on the final decision :)
Though I guess for that it doesn't actually matter if it's in a specific release, just that it's in master
 
 
1 hour later…
5:45 PM
Does anyone know if, in Laravel, if a model uses the $guarded property instead of the $fillable property, would updated_at and created_at needed to be added in that array or are they guarded by default?
I can't seem to find anything online about it
 
@Girgias Thanks. We weren't exporting one of our globals properly. I just pushed up a change so hopefully that's fixed now. :)
 
@SammyK 👍
 
6:05 PM
(nvm, was on 7.0 not 7.4; lost track of my tabs)
 
6:43 PM
Terrible performance using $query->fetch on queries with many bind parameters ・ PDO related ・ #80027
 
7:23 PM
Hey guys, does anyone know if there's any performance difference between calling something like

$foo->bar->baz multiple times as opposed to storing bar in a local variable and using it for reference?
this answer seems to say yes, but I couldn't find any info to back up the claim
12
A: PHP performance: $this->variable versus local $variable (manipulating)

th3falc0nWhen you access something in a class the PHP interpreter first has to find the class in memory and then look where the attribute is. On a plain local variable it doesn't need to search the attribute inside the class it can just access the memory of the variable directly and so it is a little fast...

 
@ZacharyCraig I would definitely assume yes but the only way to really tell is to benchmark it.
 
I guess I was hoping to see some info from the devs themselves or to get an opinion from someone like maxwell, since I know some people who are pretty intimately familiar with the inner workings hang out here
 
Either way, the difference is most likely going to be very negligible unless you're working on very performance critical code.
@ZacharyCraig 3v4l.org/c5SeB/vld#output As you can see, using vars results in fewer opcodes but whether that actually translates to better performance is unclear without benchmarks.
 
thanks for the info @IluTov
 
7:44 PM
@ZacharyCraig I feel like that question doesn't even deserve an answer :P
I am going to go ahead and say there is not a single case where it would matter
And yes that is a blanket statement :)
 
@NikiC Yeah. It'll be good to have this question answered. But on the scale of "at vote's end" versus now, we're talking less than a week. We can stay above reproach.
 
@PeeHaa And I agree with all of the above.
 
@SammyK @LeviMorrison Congrats to you, guys, for deserving Dmitry's compliments :) The only similar occasion that I remember was when he reviewed the union types PR and said something like "I don't like the feature, but this is almost the best possible implementation"
 
@MateKocsis <3
 
8:07 PM
Lol 😆
 
8:20 PM
@MateKocsis Lol, he discarded my match JIT PR and created his own, so there's that xD
 
@IluTov you only need to dabble that much until the cavilery arrives
 
@IluTov Old saying states that best agreement is when both parties are [equally] unhappy.
 
8:57 PM
@beberlei Well, I hope it wasn't actually that bad ^^ There main difference between the PRs is that I created a separate function for match but Dmitry reused and refactored some of the switch code so I hope Dmitry just thought that was the better approach (or at least that what I'm telling myself :P). Still kinda stings after all the hours I've put into it.
 
Keep telling yourself that
;-)
@StatikStasis I agree with you agreeing with all of the above
Are we streaming retro games yet @StatikStasis?
 
Not yet, sir. =( Hopefully soon.
 
Are you streaming anything at all right now or taking a well earned break ? :)
 
9:14 PM
@PeeHaa I am streaming Days Gone. Just been 2 or 3 days since last one.
Have a hard time finding time to stream daily unfortunately.
I am seeing more views now that I am multi-streaming or omni-streaming to both Twitch and YouTube live now.
 
That the one with the dude on the bike rite?
 
Yes
Zombies
 
9:41 PM
@IluTov The same happened with my return type PR :)
 
@LeviMorrison You're just saying that to make me feel better :P
 
No, he really did reimplement the whole thing, lol
 
10:03 PM
@IluTov Uh :D Maybe he doesn't know that it's possible for admins to commit to the contributors' branches directly?
 
10:31 PM
@salathe Re github.com/php/doc-en/pull/134, why not discuss the error condition? Error handling is part of documentation.
Also, whitespace issues fixed in github.com/php/doc-en/pull/135
 
@NikiC Were you involved with timeout changes on either PHP 7.0 or 7.1? I'm getting a spectacular failure on PHP 7.0 (not PHP 5, not 7.1+) when a request times out. Has to do with dd-trace-php spawning another non-PHP thread in MINIT too; if I don't spawn the thread I don't have the issue. I'm at the end of my day so I figured there's no harm in asking in hopes you just happen to know of particular changes I should look at tomorrow.
 
10:59 PM
i need help hacking my own website
<?php
if (isset($_GET['id']) && !empty($_GET['id']))
{

echo '

<input type="text" readonly hidden="hidden" name="vehicle" value="'.$_GET['id'].'" >
';

}
no matter what i manually pass on the get url i cant get it to execute a piece of code
i try to do url.com?id=asdf"><?php echo 'hello world'; ?> but it doesnt execute
 
oh noes :O
 
@WeTheBrains It won't unless you pass the string to eval. Usually this is more of a problem for JavaScript or SQL injection.
 
so everything i pass in the get url will not execute even if its javascript? so theres no way with out me having to write eval before the echo?
how can i hack my own website if its completly unsecured i can currently access a folder just by typing the name
or is it my browser also not helping?
 
@WeTheBrains No, unless you pass a tainted string to eval or the user gains access to the file system there's no easy way to make the server run arbitrary PHP code. What you can do is modify the HTML output in a way that makes the browser act differently. For example: 3v4l.org/ngkmK
 
11:15 PM
@IluTov you can always teamviewer me i have some money in my cashapp if you need any but im desperate to find a solution to this im trying to prove that this script is vulnerable my main goal is to be able to rename or delete a file or replace a word in it
 
@WeTheBrains Your script IS vulnerable, just not through PHP injection.
@WeTheBrains Try pasting this into the input: "><script>alert("hacked")</script><input type="hidden
 
@IluTov that worked like charm
what can i write in the javascript code to rename or delete a file
 
@WeTheBrains You can't. JavaScript runs in the browser, not the server. You won't have access on the file system of neither the server not the client. What you can do is display arbitrary HTML and run JavaScript (given the website isn't protected against that with the CSP header).
I feel like you should try to understand the basics of PHP, HTML and JavaScript first. If you can't separate them in your head it will be very hard to understand these concepts.
 
i code mvcs from scratch with php but i do lack some principles i though i could run code since it is echoing the input
im very bad with vulnerabilities in web development specaily with php
 
@WeTheBrains echo means write to the output buffer, it doesn't interpret the code. The browser then interprets it.
Anyway, it's time for bed (or rather, it has been for about two hours). Night guys :)
 
11:35 PM
@IluTov i coded it my self how can i know it has or doesnt have CSP header
what about with a ajax call?
 
@WeTheBrains Read here.
 
@Tpojka im not trying to make it secure, im trying to hack my own website as it is, can i make an ajax call and unlink a file?
 
What you keep missing is the difference between frontend and backend
If that would happen IRL you may or may not have a problem
 
Read there how to make your site secure. What ever opposite you do you'll fail in security (in some way). Remember there is 1 correct way and endless incorrect. Learn correct way first.
 
Also no need to star random messages :)
4
 
11:45 PM
:D
 
asshole :D
 
@PeeHaa thanks
 
@DaveRandom do kiwis count and what is it for?
 
i know the difference but my website is completly unsecured coded from scratch and im trying to hack it goal is to rename or delete a file
i have teamviewer if someone could jump in and look at my script
 
No you do not
Everything you have been asking boils down to not understanding the difference between frontend and backend
 
11:48 PM
i was thinking ajax would work with a few vulnerability inside my php already
by calling php with ajax and exploiting current un sanitized inputs
 
It is totally wrong approach.
You should ask yourself: "What can I do to secure files from being deleted?"
After you do everything industry standard suggests, next what ever you do opposite is some possibility that file could be deleted.
 
If you would actually understand the difference you would also understand there is no difference between AJAX (xhr) and "normal" requests
 
there has to be a way to hack my website
 
I am sure there is
 
i have no security no framework backing me up
i pass input values as it is
never sanitize and i even have an instance where i echo the input i also have direct access to files and folders
 
11:51 PM
You are going about it the wrong way
 
how can i do anything toward this website
 
You first need to have some understanding of what you are trying to do and how it all works
 
enlighten me
 
Enlighten yourself :P
 
11:52 PM
Start with understanding the difference between frontend and backend execution
 
You are involving more energy to BS than to actually follow good practice and make software application best you can.
 
If you fail that well you are going to fail anything after it
 
ok well mainly im trying to delete a file or rename it i have a few options since i have vulnerabilities on my php code already right?
 
this is too obvious a troll.
 
Not sure about an actual troll, but I do not disagree with the kick based on the repeat question over and over
:)
So what else is new in here?
 
11:54 PM
so...AndyRogers = ten5
Aug 22 at 14:36, by Andy Rogers
I still dont get that object creation (how do I divide into that) part; I was thinking that this is related to MVC but it is not, somebody told me
 
Heads-up @WeTheBrains; I did not kick you, but a room owner did. Please do not continue in the same way
@Danack hahahaha
I actually was online when you noticed it
Same old same old :P
 
im not asking the same question over again if someone could point me to a good ethical hacking tutorials based on php it would be awesome
 
it's sad tbh. Really wish there was a way to force someone to get some help.
 
@WeTheBrains I already told you several times where to start
 
i could follow simple samples since my script is simple itself
 
11:56 PM
@WeTheBrains you are asking dumb questions. You should be asking, how can I make my site secure.
 
I'll presume that is some hobby project.
Go with this way around: Make site for uploading and deleting files but with strictly policy that would allow file's owner only to do so. No other users mustn't ever delete other's file.

When you make this, you'll know lot of approaches of site's vulnerability.
 
@Tpojka kind of feeding the troll there...
Top-tip: reject the premise of the question.
 
@Danack One technical thing would be to be able to just ban people
 
i swear im not a troll god damn it
 
Which is not helping them... but also not not helping them
@WeTheBrains Just so you know, you are close to being kicked again
 
11:57 PM
Then say loudly if you don't understand my 6 last comments here. @WeTheBrains
 
or ask less dumb questions. Or even just ask how to ask less dumb questions.
 

« first day (3603 days earlier)      last day (1352 days later) »