« first day (1453 days earlier)      last day (3720 days later) » 

20:01
what the happy haps?
Guys, I'm making a invoice script where the Price, Client ID and such will be pulled from URL, so when I send a invoice to someone, he can just use that link to open it again whevener he wants
I was thinking of using GET for this, but I think this is a ugly solution... So I was thinking of MD5ing all varibles in one string, then decrypt it on the invoice script and show the data
and the url would look like: mysite.com/48d9fae4bb1e1d31ae73e480c166ad38
instead of showing the name of the client, price, etc
is it possible to do that with MD5, or is it a one way only ticket?
user895378
> where the Price, Client ID and such will be pulled from URL
I will generate an invoice to Apple for $1trn and demand that they pay it
user895378
mysite.com/my_invoice.php?price=0.01&comment=%5Co%2F
user895378
Hint: urldecode() the comment parameter
user895378
20:08
Sensitive pieces of information (like prices) should only ever be retrieved from an internal data source (like a database). Never from the URI or from POSTed form parameters.
More productively, @LucasB you need to store the information relating to the invoice in a database, and have the user request an invoice by ID, and require some form of authentication to verify that they can have it
Moreover, if you are doing stuff with money, ensure you are not using floating point math to handle it ;-)
If you don't know what I'm talking about, go watch Office Space
Also: do that anyway
user895378
^ that.
user895378
There's no telling how many terrifically insecure php scripts are out there doing this kind of thing and playing fast and loose with people's money. Kind of frightening.
20:11
you know, i'm just gonna go out on a limb with this one too mysite.com/my_invoice.php?invoice_id=1%27%29%3B+DROP+TABLE+Invoices%3B--
hehe - well, living and learning. I'll think about that guys, thanks
We actually have some legacy database tables that use VARCHARs to store monetary data. Even that is better than floating point.
This has been in the PHP code base for a while:
#ifdef ilia_0
static void _default_lookup_entry(zval *object, char *name, int name_len, zval **return_value TSRMLS_DC) /* {{{ */
{
        // <snip>
}
/* }}} */
#endif
#ifdef ilia_0
...
So far I'm liking this behavior: 3v4l.org/scYhF#v540. @AndreaFaulds @NikiC @ircmaxell
Oh, huh
1 !== 1.0
I guess that makes sense, but feels weird to me
20:23
@TheodoreBrown I think a lot of those conditions in double are now redundant. so something like $val === (double) (int) $val is probably already enough
@LeviMorrison Just get rid of it?
@NikiC Probably handles NAN, INF and -INF correctly now, yes.
In fact, that's what Scalar Type Hinting did in the C code.
It also works with exponents that are ints now: 3v4l.org/RfgtZ#v540
and out of range numbers as well, right?
@TheodoreBrown I don't think it should. I mean, ?id=37e7 would be ... weird
accepting 37e7 is like accepting 0x123 here
or god forbid 0123
20:25
@NikiC I suppose
yeah -e implicitly marks float
@NikiC 0123 is accepted
as base 10
@AndreaFaulds as oct I mean ;)
undefined function filter_var() in php7?
@AndreaFaulds But if the float is an int...
0123 as base 10 is okay
20:27
@PaulCrovella Bug?
likely just forgot to enable the ext
zend_string_free, zend_string_release and zend_string_delref; when should I use each one?
@LeviMorrison almost almost the 2nd
@PaulCrovella the PHP "7" builds there use the --disable-filter configure option
@AndreaFaulds That is not helpful to me. I need to know why.
20:31
@LeviMorrison zend_string_release == use zend_string_free or zend_string_delref, depending on which is appropriate
@LeviMorrison delref blindly decrements the refcount
if it's 0, it still decrements
free just frees it blindly
release delrefs and frees if 0
@LeviMorrison Yay for random devs committing random tests for their own setups \o/
we don't actually use zend_string_delref anywhere in the codebase. it's a pretty useless function ;)
If it's not used then why have it?
@NikiC Oh no, it's very useful. For causing segfaults.
20:33
@LeviMorrison API completeness
@NikiC I believe it was previously used... possibly.
lxr.php.net/… <-- indeed, currently unused
Mind if I removed it entirely?
I'm sitting here coding away and I get a bunch of text messages. A friend is asking if I think the blood moon indicates the approach of the Christian apocalypse.
i'd leave it. it doesn't hurt anyone
@NikiC I'd say it hurts the first person who uses it.
@NikiC It does hurt. Its only use is for dangerous performance optimisations.
Or what @LeviMorrison just said.
20:35
whatever
One more predicted false branch isn't such a bad penalty...
Because the CPU will assume false, and no problem.
Let's say I make a function for zend_type_decl that does the cleanup upon destruction. It's not actually reclaiming memory, though.
Just stuff like calling zend_string_release.
Should its name be zend_type_decl_dtor?
@LeviMorrison That sounds reasonable enough to me...
Until now I've only had it in one place, so I didn't bother with a function.
$ php -r 'var_dump(012 == "012");'
bool(false)
Octal is FUN!
20:39
@AndreaFaulds No, type juggling is what is fun.
agreed
Solution:
$ php -r 'function parse($x) { return eval("return ($x);"); } var_dump(012 == parse("012"));'
bool(true)
brb deploying to production...
@AndreaFaulds parse("function() { ... })(")
(sadly requiring php 7...)
@NikiC Oh no, just nest an eval. :D
@AndreaFaulds but everyone knows eval is evil
cool hackers don't use eval!
20:42
@NikiC eval is only evil because PHP isn't purely functional. In a side-effect free world, it is perfectly safe ;)
I should write a language which actively encourages using eval here.
It's just as bad in Perl...
Oh man, oh man... this gives me an idea.
it's "exception handling" in perl
PHP Object Notation. Which supports functions, so long as they're side-effect free.
@AndreaFaulds "side-effect free" as in eval :: IO a -> IO b amirite?
20:45
@NikiC Well that's only dangerous if you stick that monad in your monad (yo dawg)
anyway, gtg, eat
Okay, exponents now fail but everything else still works: 3v4l.org/jSTon#v540. @AndreaFaulds @NikiC @ircmaxell
Way simpler too! (thanks @NikiC)
@TheodoreBrown so the next question in line is whether ?id=10.0 really makes sense...
I get the argument that if we allow 10.0 we may want to allow '10.0' as well. I just wonder if that's really what we'd want to have in most practical situations?
@NikiC Perhaps not in most situations, but I can think of edge cases where it would be nice.
Oh, I am sure that such situations exist. The question is whether we want this function to do the right thing for the vast majority of cases, or whether we want it to support a broader range of values, but require additional userland checks for the common cases.
Pen test company raises a concern, our db connection password is stored in plain text in a file on disk, recommends we store it in the database, salted, and using a "secure hash like SHA256"
15
20:52
Imho, if you want to support things like '10.0' and '37e7' etc it's fine to write to_int(to_float($val))
@Leigh is that for reals?
yep
if you don't mind, what is the name of said company?
I actually don't know, customer had a pen test done, I got a PDF with no branding.
@NikiC Are there cases where accepting "10.0" would be harmful?
how about "10."?
20:55
@TheodoreBrown Well, is accepting ?id=10.0 harmful?
And if not, then why is ?id=10.0 not harmful, but ?id=10abc is?
Well 10.0 => 10 isn't lossy
(And for that matter, there's also ?id=10.000000000000000000000001 and other fun :)
@Leigh I don't even
@Leigh to be fair, that would make it more difficult for an attacker to recover
@NikiC ^ this is why my personal opinion is that all this "lossless implicit cast with errors" business is nonsense. Either you want to cast the value and deal with the fallout from nonsensical resulting data yourself, or you don't. GIGO has always worked for me.
21:00
@bwoebi the xml is too invalid for me to be able to parse it. HTML parsers think it's a weird structure and XML parsers just choke on it because of invalid characters.
I'll just throw this in here dec64.org @PaulCrovella @DaveRandom
@NikiC Good point. I don't personally have an issue writing to_int(to_float($val)) if I need to (and I think needing to do this would be very rare).
@Leigh So this company is presumably of the opinion that both the chicken and the egg happened at the same time?
I really have no idea. I literally just read the whole report again, no evidence of the company name, not even in the PDF metadata (at least they got something right)
@FlorianMargaine @bwoebi ...time for some JSON?
21:04
The most perfectly secure system conceivable is the complete lack of a system at all.
So, why stop with hashing the DB password and storing it in the DB. Just delete the whole project, no one will ever hack it then.
@TheodoreBrown however it has the problem that you may loose accuracy for large number of 64 bit systems
@Leigh even their own marketing department only knows them as "76f786c3ddc178688e1cf34367e337a2100a9e8ee51df99d214de87fffc13c86"
(which is also why you don't want to implement the string->int conversion internally by casting to float first)
@DaveRandom I think it's too late for @bwoebi to go back on his decision (w.r.t. phpstorm devs) and json... Well it's true that you'd only have to escape the quotes.
@FlorianMargaine anything new?
I'm just back connected again to the internet…
21:06
:p
The couple pings I just did :)
I'm at the point where I want to start parsing your stuff.... But yeah
@FlorianMargaine I'd be surprised if that would cost them more than a day or so...
@FlorianMargaine Well, it's on my todo-list to escape (xml encode) control chars. For now, just disable colored output.
Not even that. <> need to be escaped too
@FlorianMargaine these are escaped?
21:08
@Chris GRANT ALL ON mydb TO 'root'@'%' INDENTIFIED BY 'DROP DATABASE mydb'
@NikiC I didn't think of that. It is definitely an edge case scenario, though.
In the help command, there is a couple of them
In C, I have count = read(pipe, buffer, buffsize); and am trying to run what is received (buffer) through another executable. printf("%s", buffer); prints it out correctly, but running it through execl("/path", buffer, NULL); doesn't seem to run the executable. How can I get the string to be used as an argument for /path correctly?
Also: it's missing the XML declaration (adding it myself), I just had a parse error because of "extra content at the end of document"... Whatever that means
@bwoebi want me to go through all the commands and make you a list?
will look at it now…
21:13
I'm going to bed right now, I can compile you a list later
@FlorianMargaine no, that makes no sense. The things should be all escaped inside the printing function (phpdbg_print)
it's one central place to escape, I don't manually escape at each printing call, the printing function does the escape for me.
Some commands are working, others are not is all I can tell you :P
info f works, help doesn't, info doesn't
I'll try to make you a list tomorrow
Is that alright with you?
@FlorianMargaine does one need to escape < inside of attributes?
I actually don't escape it there…
Yeah, one needs to :P
> The ampersand character (&) and the left angle bracket (<) must not appear in their literal form, except when used as markup delimiters, or within a comment, a processing instruction, or a CDATA section.
seems so. Didn't know that… will change.
21:23
@bwoebi last one before I go to bed: try info
min
<(null) severity="" (null) msgout="" />
uh, bad
Gotta go now, I'll report an issue tomorrow if I see some others (after recompiling with your changes ofc)
good evening :)
21:25
Good night everyone!
@Leigh If they can read the file, chances are its too late.
any suggestions for a good resource to learn building a router in php? :)
This, of course, assumes certain other silly things are ignored ^^
hii all
i need one help
i am using phpmailer
sometimes i get email but some times i dont
what can be the issue please sugess
@sismaster Put debug on.
21:27
i am not getting any error always success
$mail->SMTPDebug = true; = on?
@AndreaFaulds And where would be a good place for it to be defined?
@Duikboot mate please help
1. Are you using your local computer or an online webserver?
2. have you set : $mail->SMTPDebug = 2; ( Which shows errors and other messages.)
3. $mail->Host = "localhost";
4. Check if you have a good version of the PHPMailer class.
@sismaster
Personally I don't care too much one way or the other about whether to_int("10.0") should be accepted (as long as to_int(10.5) isn't). I pushed separate branches in case anyone wants to compare the behavior: github.com/theodorejb/PolyCast/compare/….
I'll avoid merging to master unless @AndreaFaulds updates her patch (I want the library to match).
21:38
@Duikboot i made changes and test again i got email but when i am testing from MAC book dont get email strange ??
From mac as in macbook pro?
i mean i just open that same link in mac book but dint get email .
http://toplinebulldogs.com/studform.htm

This is the URL
i've filled in some parts and submitted the from
form*
yes my email is set there and i got your email
which OS are you using
Mac OSX
21:43
do you have iphone
is the simulator work for the same?
@FlorianMargaine I think JSON is the wrong thing here. It handles fragmentation worse.
sorry to say but when i filled that from from iphone it was not working to thats why i asked mate
21:49
That's weird
@Duikboot is there any chance that server marking those email as spam
If that is it should be logged somewhere I guess
@Duikboot i just rise a ticket to support team lets see what they can do but really thanks mate.
I hope you can find it out :)
22:03
@LeviMorrison zend_compile or zend_execute, presumably? but they're already too big, tbh
@NikiC So, about allowing 10.0 but not '10.0'. What's the canonical string representation of the float 10.0?
It's not 10.0 ;)
This table, though.
842,000 records, it has no autoincrement index. Instead, it has a combined key, a datetime field with an autoincrement
So the autoincrement starts back at 1 for a new datetime
And now I have to pass this stupid datetime string around with the numeric id in order to get at a given row
I want to travel back in time and throatpunch the neckbeard that made this.
@bwoebi ^
starting to look like something
@FlorianMargaine fixed the xml
but I actually have no idea what causes the memory corruption in fclose() there :o
@FlorianMargaine looks not so bad :-)
basically all I have to do is add a file for each xml tag there and add some css
@bwoebi heh, a tricky one?
good luck with that :P
@bwoebi great, I'll look it up tomorrow
I should be at bed right now
><
good night
22:08
thanks, same
@FlorianMargaine s/tricky/nearly impossible/
yet happens every time, eh? :D
@bwoebi did you fix the invalid chars in attributes or the (null) tag?
yes
I had pushed two commits.
lol
Lol
Awesome
(When all my sentences start with a capital letter, it usually means I'm on mobile.)
22:13
Hehe, I know that ;-D
Neither valgrind nor gdb give me any useful hints :-/
Tried to debug glibc?
Or simply assembly
Well, "simply"
Strace might help too
And the final good night! :D
@FlorianMargaine no, it's not the syscall. close() syscall works fine.
Good night
22:29
@FlorianMargaine bah, finding a polynominal solution to the traveling salesman problem is certainly easier than tracking down that bug. I have no clue where to begin debugging.
@bwoebi git-bisect maybe?
@hakre Uh, I know what version introduced the problem. The commit which added full-duplex connections instead of two half-duplex ones. But that doesn't help me.
I didn't see anything dubious in that commit…
@bwoebi perhaps you can split that commit and dig deeper?
23:00
prepared statements makes it more secure right?
23:16
are you asking about SQL injections? -> stackoverflow.com/questions/60174/… has quite some information.
23:28
Hi, any room to ask questions about password removal from pptx files?
@Code I can tell you where you should not ask it if that helps :)
@PeeHaa take all the chat room names of stackoverflow. remove all the rooms which you consider off topic and you have the right room.
There is nowhere on SO where that would be on topic.
@Charles do you know any s/w which removes password from .pptx files?
$tinyAvatars++
23:41
Have you tried entering the password?
morning room
morniing @Ja͢ck
Morning, and agreed, Jack, but there's no harm in a little fun.
@Charles I forgot the password
Have you tried asking someone that might remember the password what it is?
23:43
@Charles that won't help
@Code So I was bored and looked it up. The XML format used for modern Office documents uses AES-128 encryption.
Unless you're gonna brute-force the password, you are entirely out of luck.
Now, please kindly go do the needful or something.
@Charles Brute force? I have to wait may be for decades.
@Charles any clue...to open in hex editor and locating password?
The Advanced Encryption Standard (AES) is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001. AES is based on the Rijndael cipher developed by two Belgian cryptographers, Joan Daemen and Vincent Rijmen, who submitted a proposal to NIST during the AES selection process. Rijndael is a family of ciphers with different key and block sizes. For AES, NIST selected three members of the Rijndael family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits. AES has been adopted...
So, uh, no.
> The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths. The implementation of AES in products intended to protect national security systems and/or information must be reviewed and certified by NSA prior to their acquisition and use.
This stuff protects freaking literal SECRET documents for the US government. You are not going to defeat it by "finding the password with a hex editor."
@Charles thanks for the info
@Code You're welcome.
23:53
@Charles pptx use aes?
Good luck, you're gonna need it.
@PeeHaa .docx, .xslx and .pptx, yeah.
This isn't the pansy pushover "enter your lolpassword to proceed" of the past.
ow wow

« first day (1453 days earlier)      last day (3720 days later) »