Nabble - NYPHP-Talk

[ANNOUNCE] Second Andromeda hack-a-thon

2009-01-05T11:10:57Z

We will be having our second hack-a-thon on Jan 17th here on Long Island.

The focus will be taking our "free" admin screens that work in Firefox
and tweaking them up to work in IE 6 and 7. We will also start work on
a windows installer.

Location is in East Setauket, Long Island, though we welcome remote
participation as well (except you don't get any free food).

Anybody interested in participating should contact me off-list for more
information.

--
Kenneth Downs
Secure Data Software, Inc.
www.secdat.com www.andromeda-project.org
631-689-7200 Fax: 631-689-0527
cell: 631-379-0010

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: escapeshellcmd stupidity?

2009-01-03T05:09:02Z

Ajai Khattri wrote:
> On Fri, 2 Jan 2009, Allen Shaw wrote:
>
>> Basic auth seems enough to protect my todo list from abuse
>>
> Unless you're using HTTPS, that security is not sufficient since your
> password will be sent as clear text across an open network...
>
Agreed. I should have worded it more clearly: Basic auth over http seems
"secure enough" to protect my todo list from abuse, considering its
relative value to me. However, given the inherent limitations of basic
auth over a non-encrypted connection, the stakes get considerably higher
when we consider that I'm accepting shell script arguments over the web
-- poor security could easily lead to arbitrary code being passed to the
shell by anyone who cares enough to sniff out the basic auth credentials.

Basic auth will prevent the casual drifter from writing graffiti on my
todo list. To prevent real damage to the server itself, I'm relying on
the script to police the input. Bad idea?

- A.

--
Allen Shaw
slidePresenter (http://slides.sourceforge.net)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: escapeshellcmd stupidity?

2009-01-02T22:15:58Z

On Fri, 2 Jan 2009, Allen Shaw wrote:

> I have a shell script that manages my todo list, and I'd like to access
> it through the Web as well, for convenience when I'm traveling. ssh is
> not ideal here, since Web gives me access from any machine without
> downloading PuTTY, for example. Basic auth seems enough to protect my
> todo list from abuse

Unless you're using HTTPS, that security is not sufficient since your
password will be sent as clear text across an open network...

--
Aj.

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: escapeshellcmd stupidity?

2009-01-02T13:51:02Z

Daniel Convissor wrote:

On Fri, Jan 02, 2009 at 02:37:43PM -0600, Allen Shaw wrote:

In my case, I'm passing multiple arguments, but I'm now regexing them  
apart into separate arguments, so escapeshellarg() does work.

I would submit each argument as a separate POST or GET parameter.  Each 
argument would have a key (the name of the shell script flag) and a value 
(uh, the value).

I probably won't do this. I'm aiming for an interface that looks and feels like a command line. A single form field that looks and acts like a command line is a lot more fun for the user than 4 separate fields -- at least it is when I'm the user. If acceptable input for this shell script is `/path/to/script [options] action [task-number] [task-description]` then I can hardcode the script path and prompt only for the rest ([options] action [task-number] [task-description]), then manipulate the input string to get the various relevant parts.

forward compat with the wrapped shell script, I'm hoping to avoid  
checking for valid arguments and instead just escaping each argument and  
letting the shell script do its own checking.

Oh, quit whining... do the right thing. ...

Duly noted. I suppose there aren't that many possible permutations to screen for. (darn it...)

If you want to be really slick, have your shell script provide output of 
usage or a list of allowed arguments in a format that will be easy for 
your PHP script to parse into an array.  Then have the PHP script call 
the shell script using "/script --help" (or similar) and parse the output 
into an array, then use that array to validate GET/POST.

Very cool idea, actually. Unfortunately it's a public script belonging to someone else and used by a (mildly active) community, not my own shell script. Probably could parse the -h output into an array for validation, but it seems easier to just hardcode the options and check for those, then modify the php wrapper if/when the shell script interface changes.

Thanks,
A.

-- 
Allen Shaw
slidePresenter (http://slides.sourceforge.net)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: escapeshellcmd stupidity?

2009-01-02T13:26:21Z

On Fri, Jan 02, 2009 at 02:37:43PM -0600, Allen Shaw wrote:
>
> In my case, I'm passing multiple arguments, but I'm now regexing them
> apart into separate arguments, so escapeshellarg() does work.

I would submit each argument as a separate POST or GET parameter. Each
argument would have a key (the name of the shell script flag) and a value
(uh, the value).

I'd put an array of allowed flags at the top of the script. Upon
submission, I'd loop over the allowed flags and look in GET/POST to see
if the value is set and if it is pass it along into the argument list to
the shell command.

> forward compat with the wrapped shell script, I'm hoping to avoid
> checking for valid arguments and instead just escaping each argument and
> letting the shell script do its own checking.

Oh, quit whining. Suck it up and do the right thing. :)

If you want to be really slick, have your shell script provide output of
usage or a list of allowed arguments in a format that will be easy for
your PHP script to parse into an array. Then have the PHP script call
the shell script using "/script --help" (or similar) and parse the output
into an array, then use that array to validate GET/POST.

--Dan

--
T H E A N A L Y S I S A N D S O L U T I O N S C O M P A N Y
data intensive web and database programming
http://www.AnalysisAndSolutions.com/
4015 7th Ave #4, Brooklyn NY 11232 v: 718-854-0335 f: 718-854-0409
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: escapeshellcmd stupidity?

2009-01-02T12:37:43Z

Hi Chris,

Thanks for your helpful input. Some follow-up from me:

csnyder wrote:
> Allen Shaw wrote:
> > Can anyone here comment on the wisdom of relying on
> > escapeshellcmd() in a situation like this? ...
>
> First, escapeshellarg() is more specific, and therefore *possibly*
> safer. Rather than escaping the whole thing, just escape the user
> input.

In my case, I'm passing multiple arguments, but I'm now regexing them
apart into separate arguments, so escapeshellarg() does work. For
forward compat with the wrapped shell script, I'm hoping to avoid
checking for valid arguments and instead just escaping each argument and
letting the shell script do its own checking.

> Second, it would be MUCH safer to determine an acceptable range of
> possibilities for the user input... In your case you want to pass
> arbitrary strings, so validation becomes more difficult. You could
> still validate the input so that it only contains printable ascii and
> simple punctuation, no unprintable characters or newlines or any of
> that.
Okay, good thought. For this I'll remove the first 32 non-printing ASCII
chars, and DEL:
<?
$user_input = preg_replace('/[\000-\037\127]/', '', $user_input);
?>

If I'm thinking straight, the above will strip most obviously useless
chars but still allow lots of chars (e.g. i18n stuff) that I'll never be
able to whitelist.

Thanks again for your input.

- Allen
--
Allen Shaw, UPF Data Services
ashaw@... | 914.826.4622 | http://www.upf.org

--
Allen Shaw
slidePresenter (http://slides.sourceforge.net)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: escapeshellcmd stupidity?

2009-01-02T10:24:23Z

On Fri, Jan 2, 2009 at 12:05 PM, Allen Shaw <ashaw@...> wrote:

> Can anyone here comment on the wisdom of relying on escapeshellcmd() in a
> situation like this? For example:
> <?
> $script_path = '/path/to/shell/script';
> shell_exec(escapeshellcmd("$script_path {$_POST['user_input']}"));
> ?>
>
> It looks right to me, and I've confirmed that it "works," but I can't test
> to confirm it's "safe." I'd appreciate it if someone more experienced could
> tell me if this is just a Bad Idea.
>

First, escapeshellarg() is more specific, and therefore *possibly*
safer. Rather than escaping the whole thing, just escape the user
input.

Second, it would be MUCH safer to determine an acceptable range of
possibilities for the user input, or a pattern (regex or otherwise)
that it should match before being passed to the shell. In other words,
validate the input first, and then filter it when you pass it to the
shell.

In your case you want to pass arbitrary strings, so validation becomes
more difficult. You could still validate the input so that it only
contains printable ascii and simple punctuation, no unprintable
characters or newlines or any of that.
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: escapeshellcmd stupidity?

2009-01-02T09:23:46Z

Plan B.
THINGS an AMAZING GTD application that sync's up with your iPhone.
They seem to have FINALLY got it right. :-) ed

http://culturedcode.com/things/

On Fri, Jan 2, 2009 at 12:05 PM, Allen Shaw <ashaw@...> wrote:

> Hi All,
>
> I have a shell script that manages my todo list, and I'd like to access it
> through the Web as well, for convenience when I'm traveling. ssh is not
> ideal here, since Web gives me access from any machine without downloading
> PuTTY, for example. Basic auth seems enough to protect my todo list from
> abuse, but the stakes get higher when we consider that I'm accepting shell
> script arguments over the web -- poor security could easily lead to
> arbitrary code being passed to the shell.
>
> Can anyone here comment on the wisdom of relying on escapeshellcmd() in a
> situation like this? For example:
> <?
> $script_path = '/path/to/shell/script';
> shell_exec(escapeshellcmd("$script_path {$_POST['user_input']}"));
> ?>
>
> It looks right to me, and I've confirmed that it "works," but I can't test
> to confirm it's "safe." I'd appreciate it if someone more experienced could
> tell me if this is just a Bad Idea.
>
> Thanks,
> Allen
>
> --
> Allen Shaw
> slidePresenter (http://slides.sourceforge.net)
>
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php
>

--
IM/iChat: ejpusa
Links: http://del.icio.us/ejpusa
Blog: http://www.preceptress.com/blog
Follow me: http://www.twitter.com/ejpusa
Karma: http://www.coderswithconscience.com
Projects: http://flickr.com/photos/86842405@N00/
Store: http://astore.amazon.com/httpwwwutopic-20
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

escapeshellcmd stupidity?

2009-01-02T09:05:39Z

Hi All,

I have a shell script that manages my todo list, and I'd like to access
it through the Web as well, for convenience when I'm traveling. ssh is
not ideal here, since Web gives me access from any machine without
downloading PuTTY, for example. Basic auth seems enough to protect my
todo list from abuse, but the stakes get higher when we consider that
I'm accepting shell script arguments over the web -- poor security could
easily lead to arbitrary code being passed to the shell.

Can anyone here comment on the wisdom of relying on escapeshellcmd() in
a situation like this? For example:
<?
$script_path = '/path/to/shell/script';
shell_exec(escapeshellcmd("$script_path {$_POST['user_input']}"));
?>

It looks right to me, and I've confirmed that it "works," but I can't
test to confirm it's "safe." I'd appreciate it if someone more
experienced could tell me if this is just a Bad Idea.

Thanks,
Allen

--
Allen Shaw
slidePresenter (http://slides.sourceforge.net)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Open Source Project Management Tools

2008-12-31T16:34:22Z

There is also a great Trac plugin Agilo for SCRUM development cycles
we use to great success.

http://www.agile42.com/

On Wed, Dec 31, 2008 at 4:26 PM, David Krings <ramons@...> wrote:

> Hi!
>
> Count me in for QA / tech writing (help / manual). I guess I am way better
> at that than the programming.
>
> David
>
>
> y2rob@... wrote:
>>
>> i'd be interested in contributing to that :)
>>
>> ~rob
>>
>>
>> -----Original Message-----
>> From: Matt Juszczak <matt@...>
>> To: NYPHP Talk <talk@...>
>> Sent: Mon, 15 Dec 2008 12:33 am
>> Subject: Re: [nyphp-talk] Open Source Project Management Tools
>>
>>> I think Ive spent years looking for a good open source solution and Ive
>>> never found anything close. (Maybe we should write one? :-)
>>
>> Agreed. I think there's a big market here for an open source project
>> management solution. I'd gladly provide hosting/svn, etc. if people wanted
>> to get together and start one.
>>>
>>> As far as commercial solutions go, right now we're using FogBugz but
>>> Mingle looks pretty good too.
>>
>> Great! I'll look at them, thanks!
>> _______________________________________________ New York PHP User Group
>> Community Talk Mailing List http://lists.nyphp.org/mailman/listinfo/talk
>> http://www.nyphp.org/show_participation.php
>> ------------------------------------------------------------------------
>> Get a *free MP3* every day with the Spinner.com Toolbar. Get it Now
>> <http://toolbar.aol.com/spinner/download.html?ncid=emlweusdown00000020>.
>>
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> New York PHP User Group Community Talk Mailing List
>> http://lists.nyphp.org/mailman/listinfo/talk
>>
>> http://www.nyphp.org/show_participation.php
>
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php
>

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Open Source Project Management Tools

2008-12-31T16:26:33Z

Hi!

Count me in for QA / tech writing (help / manual). I guess I am way better at
that than the programming.

David

y2rob@... wrote:

> i'd be interested in contributing to that :)
>
> ~rob
>
>
> -----Original Message-----
> From: Matt Juszczak <matt@...>
> To: NYPHP Talk <talk@...>
> Sent: Mon, 15 Dec 2008 12:33 am
> Subject: Re: [nyphp-talk] Open Source Project Management Tools
>
>> I think Ive spent years looking for a good open source solution and Ive
>> never found anything close. (Maybe we should write one? :-)
>
> Agreed. I think there's a big market here for an open source project
> management solution. I'd gladly provide hosting/svn, etc. if people
> wanted to get together and start one.
>
>> As far as commercial solutions go, right now we're using FogBugz but
>> Mingle looks pretty good too.
>
> Great! I'll look at them, thanks!
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php
>
> ------------------------------------------------------------------------
> Get a *free MP3* every day with the Spinner.com Toolbar. Get it Now
> <http://toolbar.aol.com/spinner/download.html?ncid=emlweusdown00000020>.
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Open Source Project Management Tools

2008-12-31T08:19:19Z

i'd be interested in contributing to that :)

~rob

-----Original Message-----
From: Matt Juszczak <matt@...>
To: NYPHP Talk <talk@...>
Sent: Mon, 15 Dec 2008 12:33 am
Subject: Re: [nyphp-talk] Open Source Project Management Tools

> I think Ive spent years looking for a good open source solution and Ive
> never found anything close. (Maybe we should write one? :-)

Agreed. I think there's a big market here for an open source project management solution. I'd gladly provide hosting/svn, etc. if people wanted to get together and start one.

> As far as commercial solutions go, right now we're using FogBugz but
> Mingle looks pretty good too.

Great! I'll look at them, thanks!
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Get a free MP3 every day with the Spinner.com Toolbar. Get it Now.

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Server maintenance

2008-12-29T07:33:59Z

Yitzchak Schaffer wrote:
> Greetings all:
>

Whoops, wrong recipient - mea culpa, apologies!

--
Yitzchak Schaffer
Systems Librarian
Touro College Libraries
33 West 23rd Street
New York, NY 10010
Tel (212) 463-0400 x5230
Fax (212) 627-3197
yitzchas@...
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Server maintenance

2008-12-29T07:32:41Z

Greetings all:

We are doing an upgrade of the server which hosts the survey and staff
wiki; there may be brief service interruptions over the next hour or so.

Cheers,

--
Yitzchak Schaffer
Systems Librarian
Touro College Libraries
33 West 23rd Street
New York, NY 10010
Tel (212) 463-0400 x5230
Fax (212) 627-3197
yitzchas@...
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Captcha/Question

2008-12-24T14:26:00Z

The purpose of the captchas and security question is to prevent automated
login attempts and automated password guessing.

-----Original Message-----
From: talk-bounces@... [mailto:talk-bounces@...] On
Behalf Of Tom Melendez
Sent: Wednesday, December 24, 2008 5:19 PM
To: NYPHP Talk
Subject: Re: [nyphp-talk] Captcha/Question

On Wed, Dec 24, 2008 at 2:01 PM, Michele Waldman <mmwaldman@...>
wrote:
> I see zencart moved from using a captcha to a security question.
>
Do you know why? (I'm asking, I don't know why either) Do they let
you enable one instead of the other?
>
>
> They only have a finite number of questions like "What is the color of a
> blue sky?"
>
Is it possible to add your own?
>
>
> Can't that be easily gotten around?
>
> You can just read the security question from the page and program the
> response for that question.
>
Well, the answer is per user, so you would have to know their answer
to begin with, right?
>
>
> Thoughts on captchas and security questions?
>
Well, either or both combined shouldn't define your security policy.
For example, if you're running on a shared host, or non-SSL your
"security" is very limited. What are you trying to protect against?
What is your concern?

With that said, I tend to like the multi-step process that involves both.

Tom
http://www.liphp.org
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Captcha/Question

2008-12-24T14:19:12Z

On Wed, Dec 24, 2008 at 2:01 PM, Michele Waldman <mmwaldman@...> wrote:
> I see zencart moved from using a captcha to a security question.
>
Do you know why? (I'm asking, I don't know why either) Do they let
you enable one instead of the other?
>
>
> They only have a finite number of questions like "What is the color of a
> blue sky?"
>
Is it possible to add your own?
>
>
> Can't that be easily gotten around?
>
> You can just read the security question from the page and program the
> response for that question.
>
Well, the answer is per user, so you would have to know their answer
to begin with, right?
>
>
> Thoughts on captchas and security questions?
>
Well, either or both combined shouldn't define your security policy.
For example, if you're running on a shared host, or non-SSL your
"security" is very limited. What are you trying to protect against?
What is your concern?

With that said, I tend to like the multi-step process that involves both.

Tom
http://www.liphp.org
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Captcha/Question

2008-12-24T14:01:39Z

I see zencart moved from using a captcha to a security question.

They only have a finite number of questions like “What is the color of a blue sky?”

Can’t that be easily gotten around?

You can just read the security question from the page and program the response for that question.

Thoughts on captchas and security questions?

Michele

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: [Slightly OT] Profiling Site Response Time

2008-12-20T20:09:11Z

Hi Nasir:

> YSlow is my first choice for any task like this. But
> the site not working in FF

That could be the reason the site is slow. It may be downloading fine
but the browsers are choking on the rendering phase on the first page
load because your HTML or style sheets are totally broken.

--Dan

--
T H E A N A L Y S I S A N D S O L U T I O N S C O M P A N Y
data intensive web and database programming
http://www.AnalysisAndSolutions.com/
4015 7th Ave #4, Brooklyn NY 11232 v: 718-854-0335 f: 718-854-0409
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Help using a variable

2008-12-18T22:05:46Z

I sat down and re wrote all of the code and things are working.

Thnaks,

Nestor :-)

On Wed, Dec 17, 2008 at 7:38 PM, Néstor <rotsen@...> wrote:

Register Globals are OFF

:-)

On Wed, Dec 17, 2008 at 7:24 PM, Anirudhsinh Zala <arzala@...> wrote:

On Thursday 18 December 2008 05:49:15 Néstor wrote:
> I am passing a variable and value using the query method to myreport.php.
>
> I can see using phpinfo() the query string and the var and the value:
> _GET["drange"]AND (proj_adv_date >=
> DATE_FORMAT(\'2008-12-17\',\'%Y-%m-%d\') AND proj_adv_date <=
> DATE_FORMAT(\'2009-12-17\', \'%Y-%m-%d\'))
> _SERVER["QUERY_STRING"]show=1&proj_owner=Engineering&drange=AND+%28proj_adv
>_date+%3E%3D+DATE_FORMAT%28%272008-12-17%27%2C%27%25Y-%25m-%25d%27%29+AND+pr
>oj_adv_date+%3C%3D+DATE_FORMAT%28%272009-12-17%27%2C+%27%25Y-%25m-%25d%27%29
>%29
>
> _SERVER["REQUEST_URI"]/opps/eco_reports/rep/uco_report.php?show=1&proj_owne
>r=Engineering&drange=AND+%28proj_adv_date+%3E%3D+DATE_FORMAT%28%272008-12-17
>%27%2C%27%25Y-%25m-%25d%27%29+AND+proj_adv_date+%3C%3D+DATE_FORMAT%28%272009
>-12-17%27%2C+%27%25Y-%25m-%25d%27%29%29
>
>
> but when I put the following code in the program dies:
> $drange = $_GET['drange'];

Difficult to analyse but Is directive "register_globals" set to "On" either in
php.ini or in your script?

Btw, passing SQL chunk (i.e implementation logic) via query string is not good
method. Instead you should pass just necessary values of dates etc.

Thanks

Anirudh Zala

>
> I jjust discovered that if I change the variable to $xdrange the program
> does nto stop
> $xdrange = $_GET['drange'];
>
> What????
>
> I need the variable to be $drange because it is a date range that I use to
> create the query and this program calls itself.
>
> What could be causing the problem? What should I do to use this variable
> $drange?
>
> Thanks,
>
> Nestor :-)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Open Source Project Management Tools

2008-12-18T10:54:25Z

On Thu, Dec 18, 2008 at 1:32 PM, elizabeth <elizabeth@...> wrote:
> web2project is not new. It is really dotProject with a new skin but it does
> not include the Helpdesk module.

Former dotProject and current web2project contributor here...

First off, Helpdesk hasn't ever been a core module and iirc, it's
deprecated... I don't think it's a purposeful decision, just the fact
that it's rarely updated.

More importantly,, web2project is not just "dotproejct with a new skin":

* We're steadily working towards XHTML 1.0 compliance. Since I was
one of the guys to do this on the (since deprecated) dotProject Head
development, I'm taking care of these things as we can.

* The underlying permissions system has a caching layer built in.
>From our tests - both in dev and in production with 400+ products -
we've seen response times improve by over 50% and a 90% reduction in
the number of queries performed. I am hosting 5-6 production
customers on it right now.

* The security fixes are numerous, but the biggest one -
http://caseysoftware.com/blog/vulnerability-disclosure-dotproject -
limits users from performing arbitrary actions.

* We've reworked portions of the database - for example, making
enumerated types separate fields as opposed to /n delimited strings -
to make the system easier to interact with programatically. The
Vision for this is to eventually have a RESTful API included in core.
I gave a *brief* overview of it at the DCPHP Conference a while back.

* A great deal of the cruft in the system has been removed. By
simply deleting code that was executing *but not doing anything*,
we've improved response times of certain screens by 50%... independent
of the permissions caching noted above.

* In terms of general code cleanliness, we're in progress in actually
using the CakePHP coding standard to make sure things are all
readable. I've also been working to remove all the extraneous bits of
PHP from the HTML. We're no where near complete on either of these
pieces, but making things steadily better.

Next month I'll be giving a demo and overview of web2project... all
are welcome to attend the Northern Virginia Linux Users' Group (03
Jan), the DC PHP Users' Group (14 Jan), or the soon-to-be-announced
php|architect Webinar Series (mine is 23 Jan).

Thanks,
keith

--
D. Keith Casey Jr.
CEO, CaseySoftware, LLC
http://CaseySoftware.com
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Open Source Project Management Tools

2008-12-18T10:32:01Z

Hi,

web2project is not new. It is really dotProject with a new skin but it does not include the Helpdesk module.

elizabeth

Paul McGrane wrote:

You should check out web2project.net  This is a new open source project
management tool that sounds like it answers most of your issues...you can
demo it at demo.web2project.net

Paul 

-----Original Message-----
From: talk-bounces@... [talk-bounces@...] On
Behalf Of Matt Juszczak
Sent: Monday, December 15, 2008 12:34 AM
To: NYPHP Talk
Subject: Re: [nyphp-talk] Open Source Project Management Tools

I think Ive spent years looking for a good open source solution and 
Ive never found anything close. (Maybe we should write one? :-)


Agreed.  I think there's a big market here for an open source project
management solution.  I'd gladly provide hosting/svn, etc. if people wanted
to get together and start one.

As far as commercial solutions go, right now we're using FogBugz but 
Mingle looks pretty good too.


Great!  I'll look at them, thanks!
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Help using a variable

2008-12-17T19:38:19Z

:-)

On Wed, Dec 17, 2008 at 7:24 PM, Anirudhsinh Zala <arzala@...> wrote:

On Thursday 18 December 2008 05:49:15 Néstor wrote:
> I am passing a variable and value using the query method to myreport.php.
>
> I can see using phpinfo() the query string and the var and the value:
> _GET["drange"]AND (proj_adv_date >=
> DATE_FORMAT(\'2008-12-17\',\'%Y-%m-%d\') AND proj_adv_date <=
> DATE_FORMAT(\'2009-12-17\', \'%Y-%m-%d\'))
> _SERVER["QUERY_STRING"]show=1&proj_owner=Engineering&drange=AND+%28proj_adv
>_date+%3E%3D+DATE_FORMAT%28%272008-12-17%27%2C%27%25Y-%25m-%25d%27%29+AND+pr
>oj_adv_date+%3C%3D+DATE_FORMAT%28%272009-12-17%27%2C+%27%25Y-%25m-%25d%27%29
>%29
>
> _SERVER["REQUEST_URI"]/opps/eco_reports/rep/uco_report.php?show=1&proj_owne
>r=Engineering&drange=AND+%28proj_adv_date+%3E%3D+DATE_FORMAT%28%272008-12-17
>%27%2C%27%25Y-%25m-%25d%27%29+AND+proj_adv_date+%3C%3D+DATE_FORMAT%28%272009
>-12-17%27%2C+%27%25Y-%25m-%25d%27%29%29
>
>
> but when I put the following code in the program dies:
> $drange = $_GET['drange'];

Difficult to analyse but Is directive "register_globals" set to "On" either in
php.ini or in your script?

Btw, passing SQL chunk (i.e implementation logic) via query string is not good
method. Instead you should pass just necessary values of dates etc.

Thanks

Anirudh Zala

>
> I jjust discovered that if I change the variable to $xdrange the program
> does nto stop
> $xdrange = $_GET['drange'];
>
> What????
>
> I need the variable to be $drange because it is a date range that I use to
> create the query and this program calls itself.
>
> What could be causing the problem? What should I do to use this variable
> $drange?
>
> Thanks,
>
> Nestor :-)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Help using a variable

2008-12-17T19:24:42Z

On Thursday 18 December 2008 05:49:15 Néstor wrote:

Difficult to analyse but Is directive "register_globals" set to "On" either in
php.ini or in your script?

Btw, passing SQL chunk (i.e implementation logic) via query string is not good
method. Instead you should pass just necessary values of dates etc.

Thanks

Anirudh Zala

>
> I jjust discovered that if I change the variable to $xdrange the program
> does nto stop
> $xdrange = $_GET['drange'];
>
> What????
>
> I need the variable to be $drange because it is a date range that I use to
> create the query and this program calls itself.
>
> What could be causing the problem? What should I do to use this variable
> $drange?
>
> Thanks,
>
> Nestor :-)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Help using a variable

2008-12-17T16:53:53Z

When you say it "dies", you should get some sort of an error status
message. Make sure you're displaying error messages (E_ALL, maybe),
and you should get something more useful.

-b.

realm3 web applications [realm3.com]
Information architecture, application development.
phone: (917) 512-3594
fax: (440) 744-3559

On Wed, Dec 17, 2008 at 7:19 PM, Néstor <rotsen@...> wrote:

> I am passing a variable and value using the query method to myreport.php.
>
> I can see using phpinfo() the query string and the var and the value:
> _GET["drange"]AND (proj_adv_date >= DATE_FORMAT(\'2008-12-17\',\'%Y-%m-%d\')
> AND proj_adv_date <= DATE_FORMAT(\'2009-12-17\', \'%Y-%m-%d\'))
> _SERVER["QUERY_STRING"]show=1&proj_owner=Engineering&drange=AND+%28proj_adv_date+%3E%3D+DATE_FORMAT%28%272008-12-17%27%2C%27%25Y-%25m-%25d%27%29+AND+proj_adv_date+%3C%3D+DATE_FORMAT%28%272009-12-17%27%2C+%27%25Y-%25m-%25d%27%29%29
> _SERVER["REQUEST_URI"]/opps/eco_reports/rep/uco_report.php?show=1&proj_owner=Engineering&drange=AND+%28proj_adv_date+%3E%3D+DATE_FORMAT%28%272008-12-17%27%2C%27%25Y-%25m-%25d%27%29+AND+proj_adv_date+%3C%3D+DATE_FORMAT%28%272009-12-17%27%2C+%27%25Y-%25m-%25d%27%29%29
>
>
> but when I put the following code in the program dies:
> $drange = $_GET['drange'];
>
> I jjust discovered that if I change the variable to $xdrange the program
> does nto stop
> $xdrange = $_GET['drange'];
>
> What????
>
> I need the variable to be $drange because it is a date range that I use to
> create the query and this program calls itself.
>
> What could be causing the problem? What should I do to use this variable
> $drange?
>
> Thanks,
>
> Nestor :-)
>
>
>
>
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php
>

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Help using a variable

2008-12-17T16:19:15Z

I am passing a variable and value using the query method to myreport.php.

I can see using phpinfo() the query string and the var and the value:
_GET["drange"]AND (proj_adv_date >= DATE_FORMAT(\'2008-12-17\',\'%Y-%m-%d\') AND proj_adv_date <= DATE_FORMAT(\'2009-12-17\', \'%Y-%m-%d\'))
_SERVER["QUERY_STRING"]show=1&proj_owner=Engineering&drange=AND+%28proj_adv_date+%3E%3D+DATE_FORMAT%28%272008-12-17%27%2C%27%25Y-%25m-%25d%27%29+AND+proj_adv_date+%3C%3D+DATE_FORMAT%28%272009-12-17%27%2C+%27%25Y-%25m-%25d%27%29%29
_SERVER["REQUEST_URI"]/opps/eco_reports/rep/uco_report.php?show=1&proj_owner=Engineering&drange=AND+%28proj_adv_date+%3E%3D+DATE_FORMAT%28%272008-12-17%27%2C%27%25Y-%25m-%25d%27%29+AND+proj_adv_date+%3C%3D+DATE_FORMAT%28%272009-12-17%27%2C+%27%25Y-%25m-%25d%27%29%29

but when I put the following code in the program dies:
$drange = $_GET['drange'];

I jjust discovered that if I change the variable to $xdrange the program does nto stop
$xdrange = $_GET['drange'];

What????

I need the variable to be $drange because it is a date range that I use to create the query and this program calls itself.

What could be causing the problem? What should I do to use this variable $drange?

Thanks,

Nestor :-)

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: [Slightly OT] Profiling Site Response Time

2008-12-16T18:59:39Z

as far as I can tell, requests are being made, but the it seems to encounter an XML error in the first few lines of the data that is sent back.

Wasn't sure if I would get any useful data out of YSlow with that. Will try it first thing tomorrow.

- Nasir

On Tue, Dec 16, 2008 at 9:54 PM, Tom Melendez <tom@...> wrote:

On Tue, Dec 16, 2008 at 6:07 PM, Nasir Zubair <nasir81@...> wrote:
> Yeah, that's a bummer. YSlow is my first choice for any task like this. But
> the site not working in FF is one of the reason I'm looking for another
> solution.
>

What do you mean by "not working in FF"? Things just don't look right
or functionality is actually degraded, or more importantly, requests
aren't actually being made? If it just appearance, you can still get
some good data with FF.

Thanks,

Tom
http://www.liphp.org

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: [Slightly OT] Profiling Site Response Time

2008-12-16T18:54:35Z

On Tue, Dec 16, 2008 at 6:07 PM, Nasir Zubair <nasir81@...> wrote:
> Yeah, that's a bummer. YSlow is my first choice for any task like this. But
> the site not working in FF is one of the reason I'm looking for another
> solution.
>

What do you mean by "not working in FF"? Things just don't look right
or functionality is actually degraded, or more importantly, requests
aren't actually being made? If it just appearance, you can still get
some good data with FF.

Thanks,

Tom
http://www.liphp.org
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: [Slightly OT] Profiling Site Response Time

2008-12-16T18:07:47Z

Yeah, that's a bummer. YSlow is my first choice for any task like this. But the site not working in FF is one of the reason I'm looking for another solution.

- Nasir

On Tue, Dec 16, 2008 at 8:54 PM, Rolan Yang <rolan@...> wrote:

Nasir Zubair wrote:

Hi All,

Can anyone suggest an offline program or utility to profile response time for an intranet website during various visits.

I'm trying troubleshooting a peculiar problem with one of our intranet websites in IE6. The site is not fully functional in non-IE browsers (IE6 being the company standard). On the first visit to site for the day, the site takes good 30-45 seconds to respond, any subsequent visits are under 1 sec, as expected. After some general testing (cache, cookies, etc.) I am fairly confident that the workstation configuration are not a problem. The issue can be reproduced on a number of workstations using a number of different NT accounts. For every account, the slow

The fact that it doesn't work with non-IE browsers is somewhat of a hurdle, but if it does with with Firefox, there is a nice plugin called Yslow that will profile your web pages and offer suggestions on how to optimize.

~Rolan

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: [Slightly OT] Profiling Site Response Time

2008-12-16T18:06:29Z

Will try cURL and see how it works.

Just browsed through Selenium's site. Interesting concept. I will see how involved the setup is and would it even be worth the effort.

Thanks for the suggestions.

- Nasir

On Tue, Dec 16, 2008 at 8:39 PM, Brent Baisley <brenttech@...> wrote:

You can try using some unix utilities like wget to do timings. PHP has CURL commands you can use to automate some testings. There are also testing tools, like Selenium, you can use on any computer to do automated testing.

Brent

On Dec 16, 2008, at 7:21 PM, Nasir Zubair wrote:

Hi All,

Can anyone suggest an offline program or utility to profile response time for an intranet website during various visits.

I'm trying troubleshooting a peculiar problem with one of our intranet websites in IE6. The site is not fully functional in non-IE browsers (IE6 being the company standard). On the first visit to site for the day, the site takes good 30-45 seconds to respond, any subsequent visits are under 1 sec, as expected. After some general testing (cache, cookies, etc.) I am fairly confident that the workstation configuration are not a problem. The issue can be reproduced on a number of workstations using a number of different NT accounts. For every account, the slow down is only once, during the initial visit.

I have been looking for various tools to profile the site response and have consistently been running into the following issues:

1. the site is on an intranet, inaccessible from the internet, which rules out all the online tools.
2. the site is using SSL, which caused Fiddler (http://www.fiddlertool.com/fiddler/) and couple of other utilities to skip it altogether.

I am not the developer of the site in question, but since I'm given the task of troubleshooting the issue, I want to back up my obvious conclusions with some numbers.

Thanks in advance.

- Nasir

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: [Slightly OT] Profiling Site Response Time

2008-12-16T17:54:01Z

Nasir Zubair wrote:

> Hi All,
>
> Can anyone suggest an offline program or utility to profile response
> time for an intranet website during various visits.
>
> I'm trying troubleshooting a peculiar problem with one of our intranet
> websites in IE6. The site is not fully functional in non-IE browsers
> (IE6 being the company standard). On the first visit to site for the
> day, the site takes good 30-45 seconds to respond, any subsequent
> visits are under 1 sec, as expected. After some general testing
> (cache, cookies, etc.) I am fairly confident that the workstation
> configuration are not a problem. The issue can be reproduced on a
> number of workstations using a number of different NT accounts. For
> every account, the slow

The fact that it doesn't work with non-IE browsers is somewhat of a
hurdle, but if it does with with Firefox, there is a nice plugin called
Yslow that will profile your web pages and offer suggestions on how to
optimize.

~Rolan
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: [Slightly OT] Profiling Site Response Time

2008-12-16T17:39:11Z

You can try using some unix utilities like wget to do timings. PHP has CURL commands you can use to automate some testings. There are also testing tools, like Selenium, you can use on any computer to do automated testing.

Brent

On Dec 16, 2008, at 7:21 PM, Nasir Zubair wrote:

Hi All,

Can anyone suggest an offline program or utility to profile response time for an intranet website during various visits.

I'm trying troubleshooting a peculiar problem with one of our intranet websites in IE6. The site is not fully functional in non-IE browsers (IE6 being the company standard). On the first visit to site for the day, the site takes good 30-45 seconds to respond, any subsequent visits are under 1 sec, as expected. After some general testing (cache, cookies, etc.) I am fairly confident that the workstation configuration are not a problem. The issue can be reproduced on a number of workstations using a number of different NT accounts. For every account, the slow down is only once, during the initial visit.

I have been looking for various tools to profile the site response and have consistently been running into the following issues:

1. the site is on an intranet, inaccessible from the internet, which rules out all the online tools.
2. the site is using SSL, which caused Fiddler (http://www.fiddlertool.com/fiddler/) and couple of other utilities to skip it altogether.

I am not the developer of the site in question, but since I'm given the task of troubleshooting the issue, I want to back up my obvious conclusions with some numbers.

Thanks in advance.

- Nasir

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

[Slightly OT] Profiling Site Response Time

2008-12-16T16:21:55Z

Hi All,

Can anyone suggest an offline program or utility to profile response time for an intranet website during various visits.

I'm trying troubleshooting a peculiar problem with one of our intranet websites in IE6. The site is not fully functional in non-IE browsers (IE6 being the company standard). On the first visit to site for the day, the site takes good 30-45 seconds to respond, any subsequent visits are under 1 sec, as expected. After some general testing (cache, cookies, etc.) I am fairly confident that the workstation configuration are not a problem. The issue can be reproduced on a number of workstations using a number of different NT accounts. For every account, the slow down is only once, during the initial visit.

I have been looking for various tools to profile the site response and have consistently been running into the following issues:

1. the site is on an intranet, inaccessible from the internet, which rules out all the online tools.
2. the site is using SSL, which caused Fiddler (http://www.fiddlertool.com/fiddler/) and couple of other utilities to skip it altogether.

I am not the developer of the site in question, but since I'm given the task of troubleshooting the issue, I want to back up my obvious conclusions with some numbers.

Thanks in advance.

- Nasir

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Run PHP script as service (every 10 seconds)

2008-12-16T08:01:46Z

On Tue, Dec 16, 2008 at 9:43 AM, Fernando Gabrieli <fgabrieli@...> wrote:
> if you could change it so it runs every minute (instead of every 10 seconds)
> you could use a cron...
>

You probably want the script to run 10 seconds after it last ran to
prevent multiple instances in the case where the script takes more
than 10 seconds to run. If you use cron, make sure you have a lock
to prevent the script from running simultaneously.

-John Campbell
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Run PHP script as service (every 10 seconds)

2008-12-16T07:34:13Z

Fernando Gabrieli wrote:
> if you could change it so it runs every minute (instead of every 10
> seconds) you could use a cron...

Or craft the script so that it loops five times while waiting ten seconds and
then hook that script into cron.

David
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

Re: Run PHP script as service (every 10 seconds)

2008-12-16T07:15:13Z

hafez ahmad wrote:
> Dears,
>
> I need to run PHP script every 10 seconds , I can do that with (while
> true) and sleep(10), but I need to the script always run on Linux
> machine as service.
>
> Any Ideas?
>
While not as elegant as some of the other suggestions above, you could
run "screen" to create a virtual terminal that remains active (even when
you log off), then use the "watch" command to run a script every x
seconds like so:

watch -n 10 ./myphpscript

Use CTRL-A D to drop out of the screen terminal and leave it running in
the background.

~Rolan
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php