Start

Feed aggregator

PHP: Unable to find the wrapper "https"

Planet-PHP - za, 27/04/2013 - 21:08

PHP may tell you the following: 

PHP Warning: file_get_contents():
Unable to find the wrapper "https" - did you forget
to enable it when you configured PHP?

This means that PHP is not able to do secure HTTP requests. Reason for this is that it has no SSL library to use.

Unix

Recompile PHP with the --with-openssl flag.

Windows

Edit your php.ini file and add the following line: 

extension=php_openssl.dll

Categorieën: Open Source, PHP Community

Community News: Packagist Latest Releases for 04.27.2013

PHPDeveloper.org - za, 27/04/2013 - 15:09
Recent releases from the Packagist:
Categorieën: Open Source, PHP Community, PHP.net

PHPMaster.com: Better Understanding Random

PHPDeveloper.org - vr, 26/04/2013 - 18:52

On PHPMaster.com there's a new tutorial talking about randomness in PHP, what it is and some of the things it can be used for.

Use of random values is very important in the computer security field. It is crucial in computer programming for development of secure systems that are not vulnerable to malicious subversion. Cryptography relies on random value's generation and their reproducibility for unpredictable output that is core for security of any system. Random values are fundamental for secure coding practices and PHP highly makes use of them for security. You will find them used in all libraries and frameworks and almost all codes rely on them for the generation of tokens, salts and as inputs for further functions.

He talks about the important of good random numbers and some of the common uses for it including generating salts and unique identifiers. He mentions the "pseudorandomness" of PHP's generators and how they're seeded to help increase this randomness. He finishes up the tutorial with some suggestions and language features for creating "as random as possible" values like using "/dev/urandom" on Linux-based systems.

Link: http://phpmaster.com/better-understanding-random
Categorieën: Open Source, PHP Community, PHP.net

/Dev/Hell Podcast: Episode 31: Feline Tooth Extraction

PHPDeveloper.org - vr, 26/04/2013 - 17:22

The /Dev/Hell podcast has posted their latest episode - Episode #31 - Feline Tooth Extraction. The podcast is hosted by PHP community members Chris Hartjes and Ed Finkler.

Short notes time: In this episode, Chris and Ed talk about conferences we always wanted to go to, and languages & tools we'd thought we'd hate and turned out to like. Then Ed waxes on the Open Recipes project.

You can listen to this latest episode either through the in-page player or by downloading the mp3. Links to all of the technologies and tools they mention are in the show's notes on the page.

Link: http://devhell.info/post/2013-04-24/feline-tooth-extraction
Categorieën: Open Source, PHP Community, PHP.net

Software Gunslinger: PHP is meant to die, continued

PHPDeveloper.org - vr, 26/04/2013 - 16:15

In his previous post ("PHP was meant to die") the point was made that PHP isn't really designed as a language to handle long running processes very well. It's made to handle a few operations and then die at the end of the request. In this follow up post he talks more about using PHP for long running processes and a library that could help.

Yes, I already acknowledged that PHP has a garbage collection implementation starting 5.3.0 and up (opt-in or opt-out, that's not the problem). I also acknowledge that garbage collection works, and is able to take care of most circular references just fine. [...] Anyway, as previously stated too, garbage collection is a great thing, but not enough for PHP. It's a borrowed feature that does not play well with old fundamental decisions inherited from the original design. Garbage collection is not a magical solution for every problem, like many tried to argue about. Let's illustrate with another example.

His example uses the React PHP library (a non-blocking I/O platform) to handle a lot of incoming data to a port and report back some memory usage and limit settings. He explains a bit about what's happening and shares the results of the test, including the end result - a fatal error when the memory limit was hit. He still comes to the same conclusion, ultimately...PHP is just not the language to use for long-running processes that do any large amount of work.

Link: http://software-gunslinger.tumblr.com/post/48215406921/php-is-meant-to-die-continued
Categorieën: Open Source, PHP Community, PHP.net

Community News: Packagist Latest Releases for 04.26.2013

PHPDeveloper.org - vr, 26/04/2013 - 15:09
Recent releases from the Packagist:
Categorieën: Open Source, PHP Community, PHP.net

Site News: Popular Posts for the Week of 04.26.2013

PHPDeveloper.org - vr, 26/04/2013 - 14:07
Popular posts from PHPDeveloper.org for the past week:
Categorieën: Open Source, PHP Community, PHP.net

Luis Atencio: Notes on Continuous Delivery - Implementing a Testing Strategy

PHPDeveloper.org - do, 25/04/2013 - 18:55

Luis Atencio has posted the latest article in his "Continuous Delivery" series today, this time with a focus on implementing a testing strategy. This is the fourth post in the series (part 1, part 2 and part 3).

There are three things in life that are always held to be true: we will die someday; we will pay taxes; and software will have bugs.... LOL [...] A testing strategy is often overlooked in software projects. This should not be too surprising, we want to build applications quickly and release them quickly. However, leaving quality out of the picture or towards the end are terrible mistakes.

He talks some about the different types of testing that revolve around software development - "business facing" and "technology facing." These are each split down even further into things like acceptance, integration and unit testing.

Link: http://www.luisatencio.net/2013/04/notes-on-continuous-delivery.html
Categorieën: Open Source, PHP Community, PHP.net

Rob Allen: Simple logging of ZF2 exceptions

PHPDeveloper.org - do, 25/04/2013 - 17:31

In this new post to his site Rob Allen shows you how to implement a simple logging method for catching exceptions in your Zend Framework 2 application.

I recently had a problem with a ZF2 based website where users were reporting seeing the error page displayed, but I couldn't reproduce in testing. To find this problem I decided to log every exception to a file so I could then go back and work out what was happening. In a standard ZF2 application, the easiest way to do this is to add a listener to the 'dispatch.error' event and log using ZendLog.

He uses an event listener to attach a service that contains a "logException" method. This method uses the ZendLog component to write out the error message to a local log file including a backtrace of where the issue occurred.

Link: http://akrabat.com/zend-framework-2/simple-logging-of-zf2-exceptions
Categorieën: Open Source, PHP Community, PHP.net

Creating Pluggable Applications Using Data Sourcing

Planet-PHP - do, 25/04/2013 - 17:03
Categorieën: Open Source, PHP Community

PHP.net: PHP 5.5 beta 4 is now available

PHPDeveloper.org - do, 25/04/2013 - 16:15

The PHP.net site has posted about the release of PHP 5.5 beta 4, the last beta that will be made for this series.

The PHP development team announces the release of the 4th beta of PHP 5.5.0. This release fixes some bugs against beta 3 and cleans up some features. This is a development preview - do not use it in production.

Several bugs were fixed and changes made - you can read the complete list in the NEWS file. To get this latest beta and try it out with your applications (and run the tests) you can download it here (here for Windows).

Link: http://php.net/index.php#id2013-04-25-1
Categorieën: Open Source, PHP Community, PHP.net

Community News: Packagist Latest Releases for 04.25.2013

PHPDeveloper.org - do, 25/04/2013 - 15:04
Recent releases from the Packagist:
Categorieën: Open Source, PHP Community, PHP.net

SimpleID: Invalid OpenID message

Planet-PHP - do, 25/04/2013 - 07:33

SimpleID, my preferred self-hosted OpenID server software, unnerved me for quite a while with the following error message: 

HTTP/1.1 400 Bad Request

error:Invalid OpenID message.
ns:http://specs.openid.net/auth/2.0

This happened after I entered username and password to log into SimpleID, before getting redirected back to the application I wanted to login originally.

Navigating back and reloading that page always worked, but it wasn't nice to get that message in the first way.

Debugging

I expected the worst after my last OpenID debugging session, but this time it was quite simple.

At first I compared the GET variables that got sent to the login form URL with the ones that were in the POST data when submitting the form. They were equal, although I would have thought otherwise because of the Invalid OpenID message error.

The next step was to find out where this error is being thrown, which was only two nearby lines of code, of which one could be ruled out by thinking. The apparent reason for the error was that $request['openid.mode'] was not set - which is strange, because the POST data definitely contained it.

The situation was now the following:

  • I had an URL

    http://id.cweiske.de/continue?s=eJyFk...

    that got rewritten to

    /index.php?q=continue&s=eJyFk...

  • The GET parameters available in PHP only contained q, not s: 

    array(1) {
  ["q"]=>
  string(8) "continue"
}

I suspected an error with the Apache rewrite rule, but investigating that didn't yield any results: The rules were fine.

What else could it be? phpinfo() showed me the un-rewritten $_SERVER["REQUEST_URI"], and the rewritten $_SERVER["QUERY_STRING"] completely with the s parameter.

This means that stripping the s parameter happened in PHP itself, and not somewhere earlier. Placing a var_dump($_GET); at the beginning of index.php also showed that s was missing.

Now I remembered Suhosin, any my earlier problems with it. phpinfo() showed me a list of settings, one with the name 

suhosin.get.max_value_length => 512

There it was: s was some 600 bytes long, and Suhosin simply stripped it away. After modifying php.ini and reloading Apache, the error was gone.

Fin

After discovering the problem's source, I made a patch for SimpleID that checks the suhosin.get.max_value_length setting and opened a bug report for it.

Now I also know that Suhosin reports the error in /var/log/syslog (where nobody looks for apache-related errors): 

suhosin[12345]: ALERT -
configured GET variable value length limit exceeded - dropped variable 's'
(attacker '1.2.3.4', file '/path/to/id.cweiske.de/index.php')
Categorieën: Open Source, PHP Community

PHP 5.5 beta 4 is now available

Planet-PHP - do, 25/04/2013 - 00:00
The PHP development team announces the release of the 4th beta of PHP 5.5.0. This release fixes some bugs against beta 3 and cleans up some features. THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION! PHP 5.5.0beta4 is shipped with some bug fixes. Here is the list: Fixed bug #64677, execution operator `` stealing surrounding arguments.Fixed bug #64342, ZipArchive::addFile() has to check for file existence.Fixed Windows x64 version of stream_socket_pair() and improved error handling.Remove curl stream wrappersYou can read the full list of changes in the NEWS file contained in the release archive. For source downloads of PHP 5.5.0beta4 please visit the download page, Windows binaries can be found on windows.php.net/qa/. Next step is Release Candidate. Our 1st RC is expected for May 9th. Thank you for supporting PHP.
Categorieën: Open Source, PHP Community

Community News: Packagist Latest Releases for 04.24.2013

PHPDeveloper.org - wo, 24/04/2013 - 15:06
Recent releases from the Packagist:
Categorieën: Open Source, PHP Community, PHP.net

Community News: Latest Releases from PHPClasses.org

PHPDeveloper.org - wo, 24/04/2013 - 14:07
Categorieën: Open Source, PHP Community, PHP.net

PHP Podcast: Episode #2 - Adam Culp

PHPDeveloper.org - di, 23/04/2013 - 17:47

The PHP Podcast (from Zend) has posted its second episode - Episode #2, an interview with Adam Culp who recently joined the team at Zend and is a organizer for the South Florida PHP User Group.

In this episode we talk to Adam Culp on his very first day as a Zend employee. We talk about PHP community and Adam's decision to move from the realm of independent consultant to Zender! Adam is the organizer of SunshinePHP, PHP Guru and joining the Zend Professional Services Team.

You can listen to this latest episode either through the in-page player or by downloading the mp3 directly. You can also subscribe to their feed of you want this and future episodes pulled automatically.

Link: http://phppodcast.com/episode-2-adam-culp/
Categorieën: Open Source, PHP Community, PHP.net

Pádraic Brady: 20 Point List For Preventing Cross-Site Scripting In PHP

PHPDeveloper.org - di, 23/04/2013 - 16:27

Pádraic Brady has posted a 20 point list that wants to help you prevent cross-site scripting (XSS) issues in your applications.

Summarising knowledge has as much value as writing a 200 page treatise on a topic, so here is a list of 20 brief points you should bear in mind when battling Cross-Site Scripting (XSS) in PHP. Minus my usual book length brain fart . Chances are good that ignoring or acting contrary to any one of these will lead to a potential XSS vulnerability. It's not necessarily a complete list - if you think something needs to be added, let everyone know in the comments.

His tips include things like:

  • Never pass data from untrusted origins into output without either escaping or sanitising it.
  • Remember that anything not explicitly defined in source code has an untrusted origin.
  • Always include ENT_QUOTES, ENT_SUBSTITUTE and a valid character encoding when calling htmlspecialchars().
  • Use rawurlencode() to escape strings being inserted into URLs and then HTML escape the entire URL.
  • Validate all complete URLs if constructed from untrusted data.
  • Remember that HTMLPurifier is the only HTML sanitiser worth using.
  • Ensure that cookies which must only be transmitted over HTTPS are marked Secure.

He points out that XSS is still one of the most "popular" (and easy to exploit) attack methods out there, so keep these tips in mind when writing up your code.

Link: http://blog.astrumfutura.com/2013/04/20-point-list-for-preventing-cross-site-scripting-in-php
Categorieën: Open Source, PHP Community, PHP.net

Offline Access to Google and other OAuth based API

Planet-PHP - di, 23/04/2013 - 15:11
By Manuel Lemos
Some applications require access to APIs on behalf of the user even when the user is not present, i.e. offline access.

OAuth is a protocol that allows applications to obtain a token to access an API when the user is not present but when the tokens expire they need to be renewed.

Some APIs like Google and Box.net support automatic renewal of expired tokens.

Read this article to learn how to use this OAuth client class to perform offline access to an API storing tokens in a database and how to have expired tokens automatically renewed.
Categorieën: Open Source, PHP Community

Community News: Packagist Latest Releases for 04.23.2013

PHPDeveloper.org - di, 23/04/2013 - 15:01
Recent releases from the Packagist:
Categorieën: Open Source, PHP Community, PHP.net
Inhoud syndiceren