« first day (587 days earlier)      last day (4360 days later) » 

yes if you mean fixed in PHP, of course not
that's a static script, it doesn't even need dynamic processing on the server side
 
Sam
@FlorianMargaine Cheers, so if im using setTimeout i need to pass an anonymous function?
 
that's what i meant in the first place
 
nope, you need to pass a function reference
 
@Sam You need to pass a function
Not a result of a function.
 
10:01 AM
I took it as if the server provider can't do anything about it
 
PHP or whatever you wanna use -> server-side
JS -> client-side
no, of course not, i didn't mean to say that
 
Sam
@FlorianMargaine @Oleg Ahh right, cheers guys :)
 
of course you can do something about it, but you'll have to do it in your JS-code and not in the code that gets executed on the server... that's what i wanted to say
 
sure
 
@Sam another way would be like this if you don't want an anonymous function jsfiddle.net/Ralt/m2VyK/2
uh wait, this is enough jsfiddle.net/Ralt/m2VyK/3
 
10:04 AM
client side code also needs some attention, if I have client side templating, they need to escape html for instance
because default users are gonna run that code
 
Defense techniques against page inclusion in iframes are still valid?
 
iirc, yes
google still does it successfully
 
and only no script users will be safe from those exploits
 
exactly. and that's what got ignored a lot
 
Sam
@FlorianMargaine Thanks for the advice, ill have a play around till i understand what i was doing wrong
 
10:05 AM
resulting in some successful XSS-attacks
 
what was pretty awesome was the JSONP exploit with gmail
 
handle input processed with JS with the same caution as you would do when it gets handled by server-side code
 
thanks for your suggestions and advice . I am totally convinced that there's nothing for me to do to prevent anything from the client side. Ill just go home and enjoy a beer :D
 
yeah, there have been some pretty impressing attacks
 
To sum it up: use https, defend against iframe inclusion, use character escape mechanisms when updating your templates. What else?
 
10:07 AM
or "Sammy" for example
 
after that I have been autoinserting for(;;); in front of json
 
yes, it's a common technique
 
@VivekSampara Oh yeah, there are things to do.
 
Made a note of the stuff you mentioned
Anything else you guys want to add to them ?
 
read the OWASP - wiki
 
10:09 AM
I bet there's a list somewhere on the internetz that summarizes techniques that help preventing attacks on the client side.
But your best defense is server side.
 
attacks to defend against: XSS, CSRF, SQL injection
you're pretty much good with all this
let's say MITM too
 
I dont give a dogs shit on the server side :) they dint let me touch the server code . so its their headache
 
don't forget for(;;); in JSON @FlorianMargaine
 
then on the client side
you've got nothing to do.
 
10:11 AM
(if your server sends json responses)
 
@Esailija?
what's that?
who's stupid enough to write this kind of code btw?
 
well if your server sends pure JSON
 
JSONP technique for making JSON hijacking harder
 
any page on the internet can refer that with script element
sending cookies as well
then you monkey patch object/array constructors
and that page gets access to data
 
uh?
I don't get it
 
10:12 AM
and use httponly - cookies. better safe than sorry
 
what are you talking about?
 
@GNi33 the cookies are sent when requesting the script, so the server will send authenticated json response
say I'm logged in facebook
and some random page has <script src="facebook.com/myfriends.json"></script>
then the script will be something like [{},{},{}]
does nothing right?
well If I monkey patch array constructor
I can access those objects in the constructor
 
iirc it returns "security exception"
 
(in vulnerable browsers)
modern browsers don't use array constructor with []
 
yes, i know this technique
 
10:14 AM
like ?
ie 6.0
?
 
ie7 eats pretty much everything when it comes to that
 
and I couldn't even monkey patch when used with new Array() in chrome
@FlorianMargaine why would it send security exception? unless the server already handled it with referers or something
 
oh you mean, actually the script will return real datas, but the browsers just sends [{},{}..., but by overriding the array constructor you can retrieve the datas?
 
it's how JSONP works
 
can we atleast restrict a certian browser for the user to use ??
 
10:15 AM
oh, yeah
 
the script sends normal JSON, normally it doesn't do anything
 
oh alright, I get it
 
but if you monkey patch array constructor, then it does
because [] invokes array constructor in vulnerable browsers
 
so it allows you to use json - supposed to be domain-limited - on other domains
ok
 
now if I try to refer JSON with script element, that has for(;;); I will get in infinite loop
 
10:17 AM
can we make our pages accessable only if the user is using the latest browser ?
 
and I can't modify the json not to have loop, because it's cross origin
 
@VivekSampara no
 
only the original site can remove the for loop before parsing it
 
@Esailija ok, so I can crash your browser by sending you a bad page, that's it?
 
facepalm
 
10:18 AM
Hi to all i got doubt in selecting next element. can anyone clarify . this is my fiddle
 
@FlorianMargaine meh, read this :D haacked.com/archive/2008/11/20/…
 
@VivekSampara That will only create troubles for your users.
A malicious user will bypass all that.
A good user will just suffer.
 
ok thanks
 
I was wondering the same @Oleg
 
@VivekSampara think about it this way: any http request you're getting can be built from scratch
including any information it sends you
 
10:19 AM
AS in ?
can you elaborate a bit ?
 
The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web. Hypertext is a multi-linear set of objects, building a network by using logical links (the so called hyperlinks) between the nodes (e.g. text or words). HTTP is the protocol to exchange or transfer hypertext. The standards development of HTTP was coordinated by the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C), culminating in the publication of a series of Req...
 
i want to sellect very next span to the checkbox
 
any of this can be self-built
 
whats wrong with my code
 
@VivekSampara any of these can be self-built too en.wikipedia.org/wiki/List_of_HTTP_headers
 
10:21 AM
Makes sense now :) Thanks @FlorianMargaine
 
anything you're getting from the client cannot be trusted
 
@Oleg :D
 
yes, literally everything is fakeable
ip address takes some work but yea
 
And this site is build on .net 2.0 and those guys have no idea about the basic security stuff
 
@gowri the next() probably gets the next element in your selection.
 
10:23 AM
@Oleg: Span is my nect element right
 
@gowri you should know that
 
@Esailija thanks a lot :)
 
@VivekSampara: Where i m wrong
 
Actually I'm being wrong here...
 
@FlorianMargaine so if you have some legacy browser users you need some hack to make your json invalid javascript
 
10:25 AM
Am i understand thinks wrong have you checked my fiddle jsfiddle.net/gchoken/EFdVM
 
yup, something like {d:...}
 
throw ""; [{},{},{}]
!!> Array = function(){}; ["asd"];
 
huh.... seems like someone managed to break out of google chrome's sandbox recently
 
@Esailija [object Array]
 
@gowri jQuery("#select_all") is calling an id
 
10:26 AM
!!> Array = function(){};Array("asd");
 
you are not having an element with that id
 
@Esailija undefined
 
you have a class. so you might try this jQuery(".select_all")
 
see, [] doesn't use Array constructor :P
 
jQuery("#select_all") yeah lol > should be $('.select_all')
 
10:28 AM
@gowri in Jquery if you have to access through id use # and if you want to access through class use .
id suggest only ids as most of the classes are messed up :D
 
@VivekSampara: OMG How silly i am.
Thanks
 
@gowri you're welcome. glad that i was helpful :)
bye guys
 
is there some way to fully disable zooming in the samsung galaxy sII - browser (on double-tap for example) ?
 
10:50 AM
sorry, no idea
 
nah, it's not that bad after all
just working on a mobile game
and i got a bug-report that there's a slight zoom-in and zoom-out when double-tapping
i don't know why someone would file this as a bug, it's just a tiny, tiny zoom
some tickets make me want to just comment "GTFO, i haven't got time for this" on them
 
11:20 AM
hi guys
again I am coming with datatbles issue
May I get help from anybody?
 
I'm here, but for help too, so I probably can't help :)
 
@Florian
is there any option to add class for different different select box in datatables like: $("#example").dataTable().columnFilter(
{ aoColumns: [
null,
null,
null,
null,
null,
null,
{
type: "select",
values: [ 'Paid', 'Due', ]
},
null,
{
type: "select",
values: [ 'Enable', 'Disable' ]
}
]
}
);
I would be very happy if I can add one class for {
type: "select",
values: [ 'Paid', 'Due', ]
} and another class for {
type: "select",
values: [ 'Enable', 'Disable' ]
}
 
If anyone can help, I've got a summary on my question: stackoverflow.com/questions/10746069/… (The problem is I'm getting different values for the screen width in CSS and JS)
 
@GNi33
are you free to help me
 
hm?
could you explain what you are doing there?
you want to add classes to a column?
 
11:34 AM
ya actually By the following piece of code I add two select boxes
amd in the tfoot , I added blank th like <tfoot><tr><th></th><th></th><th></th><th></th><th></th><th></th><th></th><th></‌​th><th></th></tr></tfoot>
then through firebug I found out that two select box has been created but they are in the same position
thats why I think if I can add custom class for those two select box then I can distinguish those select box
did it make sense to u?
 
hm... let me have a look at the docs
 
sure
 
i guess it was "sClass"
 
but sClass is for all the select boxes right?
 
they are in different columns, right?
 
11:41 AM
ya
 
so you can just add a class to the column using sClass
and then
 
I use also like {
sClass: "xx",
type: "select",
values: [ 'Paid', 'Due', ]
},
 
$('#idofyourtable').find('.classNameOfYourColumn select');
 
but no result
 
no class appended to the column?
 
11:42 AM
no
 
hm, weird
are you using it correctly?
 
let me check
if I use like $("#example").dataTable().columnFilter(
{ aoColumns: [
{ "sClass": "xx" },
null,
null,
null,
null,
null,
null,
{

type: "select",
values: [ 'Paid', 'Due', ]
},
null,
{

type: "select",
values: [ 'Enable', 'Disable' ]
}
]
}
);
instead of $("#example").dataTable().columnFilter(
{ aoColumns: [

null,
null,
null,
null,
null,
null,
{

type: "select",
values: [ 'Paid', 'Due', ]
},
null,
{

type: "select",
values: [ 'Enable', 'Disable' ]
}
]
}
);



});
then only one select box is coming
 
holy code-pasting
 
2nd select box is nott showing even from firebug
 
so, in your first example, you should get the class "xx" on your first column
 
11:47 AM
only to show you
no
"xx" is not fetching anyhow
 
12:09 PM
My office smells like garbage... bad.
i changed my garbage yesterday... all that was in there was a little letftover chicken club sandwich.. but that was only from yesterdays lunch
 
Hi, does js toString method add the decimal part while converting int to string?
 
no
9.toString() === "9"
 
mmmm ok thanks
what's the difference between == and === ?
 
Rlemon did you saw Iron Man ?
 
== is truthy === is exactly equal to
0 == "0" // true
0 === "0" // false, this also checks types.
 
12:13 PM
fuck joomla
fuck it so hard
 
i tried... she wasn't interested.
 
wow didn't know that, thanks @rlemon
@FlorianMargaine joomla is easy to set up, hard to make it work as you want :(
 
@BeNdErR there is much more to it than that, i suggest you do a quick google search.
 
joomla is a pain in the ass
 
337
Q: JavaScript === vs == : Does it matter which "equal" operator I use?

bcaspI'm using JSLint to go through some horrific JavaScript at work and it's returning a huge number of suggestions to replace == with === when doing things like comparing idSele_UNVEHtype.value.length == 0 inside of an if statement. I'm basically wondering if there is a performance benefit to repla...

 
12:14 PM
sure, install's done in 5 minutes
but then...
 
then.. PROBLEEEEEMS
waiting for you
 
false == null       // false
null == undefined   // true
lol...
 
'' == '0'           // false
0 == ''             // true
0 == '0'            // true

false == 'false'    // false
false == '0'        // true

false == undefined  // false
false == null       // false
null == undefined   // true

' \t\r\n ' == 0     // true
The lack of transitivity is alarming. My advice is to never use the evil twins. Instead, always use === and !==. All of the comparisons just shown produce false with the === operator.
 
no wait
 
Jesus christ :-|
 
12:16 PM
yeah, the most interesting is this one
'' == '0'           // false
0 == ''             // true
uh no
I suck at reading, nvm
 
''*1 == '0' woot
 
i just think the last statement is a little over zealous. don't never use them, just make 100% sure when you are using == you know exactly what you are doing.
 
thing is, if you're using jslint/jshint it will complain
 
that would make sense as that comment was the Crock's and he wrote hint/lint
which is why I try not to use said services... too much... they make you code in accordance with his style, not your own.
 
man, this guy is one upvote away from the golden badge stackoverflow.com/a/359547/851498
jshint allows you to define your own style :)
 
12:19 PM
lol
@FlorianMargaine thats why I said... too much... :P i still use them. but i ignore a lot of their warnings.
 
jsfiddle.net/rlemon/cs3DL <- point and case for jshint :P
no semicolons and it never seems to like for in loops.
problem is that code is correct. might not be the best code imo (no semicolons).
 
semicolons is well handled by jshint
and who uses for in btw? :p
Object.keys is the way to go :3
 
uhm does anyone knows how to disable a <select> in jquerymobile?
 
@BeNdErR well in the good old days we would just add a 'disabled' attrib/prop
 
12:27 PM
if I simply add disabled="disabled" jquerymoble adds automatically a bunch of classes to the element
and if i want to remove disabled dinamically
I've to remove like 4 classes..
 
because jQuery Mobile is a hunk of crap.
i strongly suggest you move away from it
 
eh..
I can't decide it :D
 
@BeNdErR what about el.disabled = true?
 
would somebody like to touch and drag it to spin ?
 
12:29 PM
@FlorianMargaine let me try, brb
not working :(
 
@Abhishek looks like buggy, I somehow get "undefined" sometimes
once out of two tries, if I just click on the circle, I get undefined
 
i also found this:

http://jquerymobile.com/test/docs/forms/docs-forms.html

but is not working -.-
 
Yeah i fixed the undefined
(XD)
it was getting called
 
as Draw(); /* old syntax */
 
12:33 PM
any quick function to write var_dump to file?
 
instead of Draw(values);
in Php ?
Florian wanna help me remove the jQuery part of that ?
 
php yeah
let me look
but I don't have much time
i'm having an exam soon
 
:O nvm then
 
@Abhishek you need cross-browser?
 
nope
just a webkit
actually thats for phones :P
 
12:36 PM
@BeNdErR ok why do you care that it is adding the classes/
 
// will replace the mouse with touch
 
it is already adding like 40 elements to mask the select and create some new dropdown menu.
and... for the new menu to look and function properly these classes are needed.
 
@rlemon yes
but i need to add and remove de disabled property dinamically..
to add ui-disabled class
or remove it
 
you wanna use jQM.. you have to deal with the fact that it is masking everything - so you really can't use html elements how you would notmally.
 
@Abhishek jsfiddle.net/Ralt/btguf/10 you just need to replace the offset() function by the corresponding one (don't remember which)
 
12:37 PM
$('#select-choice-1').selectmenu('disable'); // /enable
 
nono
 
I did that
 
i don't want a choice to be desabled
 
v
 
i want the ENTIRE select to be desabled
 
12:38 PM
off = {
                      left:that.offsetLeft,
                      top:that.offsetTop
                  }
 
till the user selects a value in another part of the page
 
^ there is you enabling of a disabled field.
 
omg it works O_O
let me try on my code, brb
 
@BeNdErR yea... when you disable the select menu it gets disabled.
the 'choice' being disabled in the css was due to the masked input.
 
LOL i tryed everything but that one
i love you rlemon
thanks
 
12:42 PM
changed a bit of syntax that you put in Florain
jsfiddle.net/darkyen/btguf/12 <- Look Sir no jQuery!
 
> Uncaught ReferenceError: $ is not defined (x7)
 
??
wut ?
 
> var self = $(this),that = this,
 
x
x( oh man XD
idk why i left it there
 
i generally go for the _ method over that = this
var _this = this;
 
12:47 PM
Now lets add a nice lil scrollable to this
and we get a nice circular control based scroller for iPhone <3
Maybe I need to constrain this aswell :/
right @rlemon ?
 
hmmmm.. how can I listen to an input value change, and as soon as the user inputs 1 or more characters, disable the <select> element?
i tryed with a $('#textinput').change(function(){blahblah})
but to see the <select> disabled i need to click outside the textbox
do I have to listen to keypressed event?
 
@rlemon big brother how do i constrain that circle ?
to support multiple rotations ?
 

« first day (587 days earlier)      last day (4360 days later) »