Nabble - NYPhp

Immediate need for PHP E-commerce developer - Midtown NYC

2008-12-04T13:00:24Z

Robert Half Technology is currently recruiting for a PHP E-Commerce Web Developer for a month long project that could extend. Our client is a successful mid-sized interactive agency who has an excess of projects needing completion by mid January.

-Our client is looking for experience in developing e-commerce sites and content management systems for consumer facing sites.

-Ideally we are looking for an individual strong in both front end and back end developing on an open source platform.

-Strong back end development is the focus of this position.

-Strong PHP5 + MySQL experience required

-Experience with HMTL, CSS, XML and JavaScript will be required.

-Individuals with experience with tools such as a Silverstripe and Magento will be given priority review.

Thank you,

John Terkovich

Account Executive

Robert Half Technology

245 Park Avenue, 25th Floor

New York, NY 10167

Tel: 212.687.7072

Fax: 212.973.0818

E-Mail: john.terkovich@...

Website: www.rht.com

Robert Half International has been named to the America’s Most Admired Companies list by Fortune magazine, ranking number one in the temporary help industry.

_______________________________________________
New York PHP Community Jobs Mailing List
http://lists.nyphp.org/mailman/listinfo/jobs

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

From forum: NYPHP-Jobs

Sr. PHP developer needed in Midtown

2008-12-04T09:15:20Z

Sr. PHP Application Developer Software Engineer

To $120K. Exceptional Benefit Package includes stock options

The Director of Engineering is new and is growing the engineering team. Currently, there are three PHP Developers, 2 Jr., 1 Mid-level. This is a newly-created Senior PHP Developer.

Job Description

Client is looking for a full-time senior PHP application developer with exceptional talent, an abundance of energy, and a high-degree of self-motivation, to work with our cutting edge Platform. We are the leading provider of multivariable testing solutions for companies doing business on the web, and we help our clients maximize their conversion rates online through real-time testing of landing pages, registration pages, and other points of customer interaction. This is called Adaptive Targeting.

This a challenging position not suitable for novices. This new Sr. Developer will be improving upon the features they currently offer. There is a lot of growth potential here…

Required Skills

Excellent written communication, organizational, and time-management skills, and a conscientious nature are required.

Required Experience

Education:

MSEE/CS. 7 years of related experience and/or BSEE/CS degree with 10 years experience or equivalent combination of education and related experience.

Core Skills:

5+ years of experience PHP.
7+ years of experience MySQL.
7+ years of experience JavaScript.
7+ years of experience Application architecture and design in high performance PHP/MySQL environment.

Other preferred skills:

HTML CSS XML Ajax C Red Hat Linux.
Experience with building C extensions for PHP would be a real plus.
Our architecture is object based, so a solid understanding of object oriented programming concepts and principles is crucial.
Some experience with other languages such as Perl, C++, .NET, etc. would be beneficial

CONTACT KEVIN LESTER

@ 212 293 4367

klester@...

Kevin R. Lester

V.P. Resource & Account Management

Concepts in Staffing

9 East 37^th Street

3^rd Floor

New York, N.Y.10016

212 293 4367 (direct)

862 252 0977 (cell)

klester@...

PHP-NY.doc (41K) Download Attachment

From forum: NYPHP-Jobs

Re: PHP/Java Bridge

2008-12-04T09:00:38Z

Hi Donald,

> From: "Donald J. Organ IV" <dorgan@...>
> To: NYPHP Talk <talk@...>
> Date: 12/03/2008 03:48 PM
> Subject: [nyphp-talk] PHP/Java Bridge
>
> So I am trying to use Apache Lucene to add searching to a
> site I am working on. And so far I have been able to use
> the PHP/Java Bridge for this.
>
> http://php-java-bridge.sourceforge.net/pjb/
>
> Has anyone used this before??
>
> For the most part I have this working but I am trying to
> impletement MultiFieldQueryParser but not sure how to pass
> the fields. I have tried the following:
>
> $parser = new Java(
> 'org.apache.lucene.queryParser.MultiFieldQueryParser',array
> ('name','description'),$analyzer );
>
> I have also tried:
> $parser = new Java(
>

'org.apache.lucene.queryParser.MultiFieldQueryParser',"name,description",

> $analyzer );
>
> AND
> $parser = new Java(
> 'org.apache.lucene.queryParser.MultiFieldQueryParser',"name
> description",$analyzer );
>
> And I am not getting anything, has anyone done this before??
>
> Thanks,
>
> Donald

I was going to recommend you post this over to the PHP/Java Bridge list,
but I see you've already done that :)

I have not used Lucene before, but there are some resources I came across
when building a Project Zero/WebSphere sMash app recently. They may be
of use:

http://www.projectzero.org/blog/index.php/2008/10/28/searching-for-information-with-php-java-and-apache-lucene/
http://www.ibm.com/developerworks/websphere/library/techarticles/0809_phillips/0809_phillips.html

Thanks,
-Dan

Daniel Krook
Senior IT Specialist - Content Tools Developer, Global Solutions, ibm.com
IBM Certified IT Specialist, SCSA, SCJP, SCWCD, ZCE, ICDAssoc., ICAD

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Immediate need for QA engineer with heavy LAMP experience - midtown NYC

2008-12-04T07:49:25Z

Robert Half Technology is currently recruiting for an immediate job opportunity in Midtown Manhattan. The position is a month long (could extend longer) contract for a major entertainment company. Below is a job description:

- Hands-on Quality Assurance professional with several years of experience conducting quality assurance testing for enterprise Web site.

- Must be adept and speedy at writing test plans and conducting rigorous testing of Web applications

- Must be extremely comfortable with back-end (as opposed to interface) testing (e.g. verifying and manipulating data in MySQL and Oracle databases)

- Experienced, fast, thorough

- Must have experience with LAMP environment.

- Must have a working knowledge of quality assurance methodologies.

- Familiarity with Linux, PHP, MYSQL, XML and Oracle.

- Creativity and the ability to work in a high-volume work environment are required

Thank you,

John Terkovich

Account Executive

Robert Half Technology

245 Park Avenue, 25th Floor

New York, NY 10167

Tel: 212.687.7072

Fax: 212.973.0818

E-Mail: john.terkovich@...

Website: www.rht.com

Robert Half International has been named to the America’s Most Admired Companies list by Fortune magazine, ranking number one in the temporary help industry.

From forum: NYPHP-Jobs

Re: Session timing out too soon

2008-12-04T07:30:41Z

That was an awesome read.

I felt really good for doing something similar for some years now :)

I also agree that authentication should not rely on anything more than a well written algorythm.

Petros Ziogas

http://www.royalblue.gr

On Thu, Dec 4, 2008 at 5:09 PM, Paul A Houle <paul@...> wrote:

Dan Cech wrote:

If you switch to a custom session storage system (ie, database-backed
sessions), then you can control the GC this way because they won't be
cleaned up by the default garbage collector.

This is the real answer. PHP sessions (as well as the session mechanisms built into other systems such as JSP and ASP.NET) are flawed in a number of ways. They are highly seductive to newbies, since they help you write an application that almost works quickly, but you can spend forever dealing with glitches and stability problems with them.

User authentication should be done like this:

http://pdos.csail.mit.edu/papers/webauth:sec10.pdf

That paper has been around for a decade and it still astonishes me that people are still using authentication systems that don't really work. I mean, an authentication system that's bound to a specific language? That isn't good enough for the booby prize, never mind the enterprise.
The cryptography-based system in the above paper is scalable and can be implemented in about 100 lines of code in just about any language. That mean you can log in once and access applications written in PHP, Perl, Java, Ruby, C# or whatever. It's possible to authenticate a user using only cryptography, so you put a very limited load on a central database or session store.

Other than that, it turns out that the sessions scope is rarely the ~correct~ scope for any application. For instance, I've seen that sites that use language-bound sesson mechanisms often lose about 50% of sales because of glitches. These glitches are hard to reproduce or monitor because session systems don't provide any log of lost shopping carts. You'll hear businessmen complain about how they can't afford to do things right, but then they're just happy to lose $2K of sales a day to a bad shopping cart.

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Session timing out too soon

2008-12-04T07:09:26Z

Dan Cech wrote:
> If you switch to a custom session storage system (ie, database-backed
> sessions), then you can control the GC this way because they won't be
> cleaned up by the default garbage collector.
>
This is the real answer. PHP sessions (as well as the session
mechanisms built into other systems such as JSP and ASP.NET) are flawed
in a number of ways. They are highly seductive to newbies, since they
help you write an application that almost works quickly, but you can
spend forever dealing with glitches and stability problems with them.

User authentication should be done like this:

http://pdos.csail.mit.edu/papers/webauth:sec10.pdf

That paper has been around for a decade and it still astonishes me
that people are still using authentication systems that don't really
work. I mean, an authentication system that's bound to a specific
language? That isn't good enough for the booby prize, never mind the
enterprise.

The cryptography-based system in the above paper is scalable and can be
implemented in about 100 lines of code in just about any language. That
mean you can log in once and access applications written in PHP, Perl,
Java, Ruby, C# or whatever. It's possible to authenticate a user
using only cryptography, so you put a very limited load on a central
database or session store.

Other than that, it turns out that the sessions scope is rarely the
~correct~ scope for any application. For instance, I've seen that
sites that use language-bound sesson mechanisms often lose about 50% of
sales because of glitches. These glitches are hard to reproduce or
monitor because session systems don't provide any log of lost shopping
carts. You'll hear businessmen complain about how they can't afford to
do things right, but then they're just happy to lose $2K of sales a day
to a bad shopping cart.
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Session timing out too soon

2008-12-04T06:31:31Z

On Thursday 04 December 2008, Aaron Fischer wrote:

> Greetings,

> I have an application built for internal use that has a user login and

> then uses sessions to track their state. I am running into a problem

> in that their session seems to expire if they are on one page for

> somewhere between 15-25 minutes. This creates a big problem because

> they type up a long report, submit it and then get booted out of the

> application without the report being saved.

> I would like to have the user be able to be logged in for a full eight

> hour day, regardless of their level of activity.

> How would I do this? I would appreciate any suggestions. Also of

> note, I am in a shared hosting environment.

This one has been asked before. The default lifetime for sessions is 24 minutes. However, in a shared environment, the default lifetime is the lowest of any user's choice; so if one user on the shared server has the default lifetime set to 1 minute, EVERYONE'S sessions expire after one minute (more or less; read up on how session files are randomly deleted). Because PHP can't tell the difference between that user's session files and your session files, they're all in the same common directory.

So. What you need to do is specify your own directory for your session files (/sharedserver/myroot/mysessionfiles/), and then set the cleanup lifetime to whatever you want (session.gc_maxlifetime).

Here's an explanation with some sample code:

http://www.captain.at/howto-php-sessions.php

Michael Sims

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Session timing out too soon

2008-12-04T06:23:27Z

Aaron Fischer wrote:
> I would like to have the user be able to be logged in for a full eight
> hour day, regardless of their level of activity.
>
> How would I do this? I would appreciate any suggestions. Also of note,
> I am in a shared hosting environment.
>
> I tried three different solutions without any luck so far:
> 1) Using session_set_cookie_params() to extend the lifetime of the
> session cookie.

The default setting of 0 for session.cookie_lifetime means 'until the
browser is closed', so you shouldn't need to mess with this.

> 2) Using a javascript function to to periodically call an image to
> simulate page activity.

You're on the right track here, but you need to be calling a php script
which accesses the session to renew the last access time. Just
requesting a static image won't do it.

> 3) Using ini_set(session.gc_maxlifetime) to set the the number of
> seconds for php to wait before data may be seen as garbage and be
> cleaned up.

The problem you're most likely having here is that any scripts on the
machine which don't have this setting will trigger the session garbage
collector with the default settings, and cheerfully delete your session
files.

If you switch to a custom session storage system (ie, database-backed
sessions), then you can control the GC this way because they won't be
cleaned up by the default garbage collector.

Dan

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Session timing out too soon

2008-12-04T06:12:36Z

Greetings,

I have an application built for internal use that has a user login and
then uses sessions to track their state. I am running into a problem
in that their session seems to expire if they are on one page for
somewhere between 15-25 minutes. This creates a big problem because
they type up a long report, submit it and then get booted out of the
application without the report being saved.

I would like to have the user be able to be logged in for a full eight
hour day, regardless of their level of activity.

How would I do this? I would appreciate any suggestions. Also of
note, I am in a shared hosting environment.

I tried three different solutions without any luck so far:
1) Using session_set_cookie_params() to extend the lifetime of the
session cookie.
2) Using a javascript function to to periodically call an image to
simulate page activity.
3) Using ini_set(session.gc_maxlifetime) to set the the number of
seconds for php to wait before data may be seen as garbage and be
cleaned up.

Thanks,

-Aaron
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Downloading File Outside of the Root

2008-12-03T20:36:56Z

Randal Rust wrote:
> On Wed, Dec 3, 2008 at 3:43 PM, Joseph Crawford <codebowl@...> wrote:
>
>
>> Like I said have a php script serve it as a download. Doing it this way
>> allows you to make sure that the user logged in.
>>
>
> Thanks, Joe. It worked perfectly!
>

This question and solution seems to come up time and time again. Perhaps
it needs to be incorporated in the FAQ.

~Rolan
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Downloading File Outside of the Root

2008-12-03T12:55:10Z

On Wed, Dec 3, 2008 at 3:43 PM, Joseph Crawford <codebowl@...> wrote:

> Like I said have a php script serve it as a download. Doing it this way
> allows you to make sure that the user logged in.

Thanks, Joe. It worked perfectly!

--
Randal Rust
R.Squared Communications
www.r2communications.com
614-370-0036
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

PHP/Java Bridge

2008-12-03T12:47:00Z

So I am trying to use Apache Lucene to add searching to a site I am working on. And so far I have been able to use the PHP/Java Bridge for this.

http://php-java-bridge.sourceforge.net/pjb/

Has anyone used this before??

For the most part I have this working but I am trying to impletement MultiFieldQueryParser but not sure how to pass the fields. I have tried the following:

$parser = new Java( 'org.apache.lucene.queryParser.MultiFieldQueryParser',array('name','description'),$analyzer );

I have also tried:
$parser = new Java( 'org.apache.lucene.queryParser.MultiFieldQueryParser',"name,description",$analyzer );

AND
$parser = new Java( 'org.apache.lucene.queryParser.MultiFieldQueryParser',"name description",$analyzer );

And I am not getting anything, has anyone done this before??

Thanks,

Donald
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Downloading File Outside of the Root

2008-12-03T12:43:37Z

Like I said have a php script serve it as a download. Doing it this
way allows you to make sure that the user logged in.

On Dec 3, 2008, at 3:36 PM, Randal Rust wrote:

> On Wed, Dec 3, 2008 at 3:33 PM, Ben Sgro <ben@...>
> wrote:
>
>> Why not just email them the book (size permitting)?
>
> It's too big. My other option is Amazon S3, which we've already used
> on another, larger project. But I thought it would be kind of useful
> to figure out how to do it this way as well.
>
> I'm not really concerned about the customer downloading the book
> multiple times, I just don't want people to be able to access it
> directly and get it.
>
> --
> Randal Rust
> R.Squared Communications
> www.r2communications.com
> 614-370-0036
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Downloading File Outside of the Root

2008-12-03T12:36:14Z

On Wed, Dec 3, 2008 at 3:33 PM, Ben Sgro <ben@...> wrote:

> Why not just email them the book (size permitting)?

It's too big. My other option is Amazon S3, which we've already used
on another, larger project. But I thought it would be kind of useful
to figure out how to do it this way as well.

I'm not really concerned about the customer downloading the book
multiple times, I just don't want people to be able to access it
directly and get it.

--
Randal Rust
R.Squared Communications
www.r2communications.com
614-370-0036
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Downloading File Outside of the Root

2008-12-03T12:33:15Z

Hello,

Why not just email them the book (size permitting)?

- Ben

Joseph Crawford wrote:

> If you want the file to live outside the www that's fine, but i doubt
> you can do it like you did in the rewrite. I would make the rewrite
> point to a php script that reads the file then outputs it for download
> using the appropriate headers etc.
>
> On Dec 3, 2008, at 3:23 PM, Randal Rust wrote:
>
>> We are working on a small site where the client has an eBook for sale.
>> Once the purchase is completed, we want to provide the link to the
>> file, which we'd like to have sit outside of the server root. We are
>> trying to work this out by modifying the .htaccess file with the
>> following command.
>>
>> RewriteRule
>> ^download/pdf/book.pdf
>> /home/cooking/wwwroot/pdf/book.pdf
>>
>> Unfortunately we keep getting 404 errors. This is a shared
>> environment, so the host may not even allow this, but does anyone see
>> anything that would keep this from working properly? FYI, I spaced it
>> out here for readability. It's one line in the file.
>>
>> --
>> Randal Rust
>> R.Squared Communications
>> www.r2communications.com
>> 614-370-0036
>> _______________________________________________
>> New York PHP User Group Community Talk Mailing List
>> http://lists.nyphp.org/mailman/listinfo/talk
>>
>> http://www.nyphp.org/show_participation.php
>
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php
>

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Downloading File Outside of the Root

2008-12-03T12:26:17Z

If you want the file to live outside the www that's fine, but i doubt
you can do it like you did in the rewrite. I would make the rewrite
point to a php script that reads the file then outputs it for download
using the appropriate headers etc.

On Dec 3, 2008, at 3:23 PM, Randal Rust wrote:

> We are working on a small site where the client has an eBook for sale.
> Once the purchase is completed, we want to provide the link to the
> file, which we'd like to have sit outside of the server root. We are
> trying to work this out by modifying the .htaccess file with the
> following command.
>
> RewriteRule
> ^download/pdf/book.pdf
> /home/cooking/wwwroot/pdf/book.pdf
>
> Unfortunately we keep getting 404 errors. This is a shared
> environment, so the host may not even allow this, but does anyone see
> anything that would keep this from working properly? FYI, I spaced it
> out here for readability. It's one line in the file.
>
> --
> Randal Rust
> R.Squared Communications
> www.r2communications.com
> 614-370-0036
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Downloading File Outside of the Root

2008-12-03T12:23:06Z

We are working on a small site where the client has an eBook for sale.
Once the purchase is completed, we want to provide the link to the
file, which we'd like to have sit outside of the server root. We are
trying to work this out by modifying the .htaccess file with the
following command.

RewriteRule
^download/pdf/book.pdf
/home/cooking/wwwroot/pdf/book.pdf

Unfortunately we keep getting 404 errors. This is a shared
environment, so the host may not even allow this, but does anyone see
anything that would keep this from working properly? FYI, I spaced it
out here for readability. It's one line in the file.

--
Randal Rust
R.Squared Communications
www.r2communications.com
614-370-0036
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: OT Quicktime to Flash convertor

2008-12-02T12:28:15Z

ffmpeg

I compile it myself on linux, but I'm sure you can find windows binaries.

The developers of the project rarely do formal releases and highly encourage you to download the latest code from SVN. I find it an annoying policy on their part, but would find it forgivable it they would at least linked to websites that provided binaries.

On Tue, Dec 2, 2008 at 3:18 PM, Michael Southwell <michael.southwell@...> wrote:

Does anybody know of one, preferably free, capable of converting a 650M file?
--
=================
Michael Southwell
Vice President, Education
NYPHP TRAINING: http://nyphp.com/Training/Indepth
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

OT Quicktime to Flash convertor

2008-12-02T12:18:40Z

Does anybody know of one, preferably free, capable of converting a 650M
file?
--
=================
Michael Southwell
Vice President, Education
NYPHP TRAINING: http://nyphp.com/Training/Indepth
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: how to correct wrong mysql datetime columns?

2008-12-02T09:55:54Z

I love answering my own questions (no sarcasm intended).

SELECT timestampdiff(SECOND, '1993-03-03 18:40:05', '2008-12-02 09:20:05');

Answer: 497025600

UPDATE your_table set created = date_add(created, INTERVAL 497025600 SECOND) WHERE year(created) = 1993;

If anyone sees anything worth commenting please feel free. Otherwise, case closed, just thought I'd post an answer for the record.

On Tue, Dec 2, 2008 at 10:45 AM, David Mintz <david@...> wrote:

This isn't necessarily PHP but... close enough? You could script a solution in PHP and indeed I might.

I had two CentOS servers' date info somehow go bad over the weekend. When I came back to work they thought it was 1993, wreaking havoc with the PHP/MySQL application hosted thereon. I restarted ntpd and they are now apparently doing fine, thanks. But I have some tables where the record creation date is saved using MySQL's now(). There are now some rows with the wrong value in this field and I am not quite clever enough to see the best way to fix.

The last output I have from the 'date' command before it was corrected is Wed Mar 3 18:40:05 EST 1993. When we got back to the present, 'date' said Tue Dec 2 09:20:05 EST 2008. Should I convert both to Unix timestamps, subtract the smaller from the larger and add that number of seconds to the values that I know are wrong? btw I know this number won't be exact but close enough will do, there being no alternative AFAIK.

Gratefully,

--
David Mintz
http://davidmintz.org/

The subtle source is clear and bright
The tributary streams flow through the darkness

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-02T09:27:48Z

On Tue, 2 Dec 2008, tedd wrote:

> Crap!
>
> I have enough to keep up with as it is.

As someone else pointed out, if you don't then you should probably hire
someone to deploy your app and manage your servers for you.

--
Aj.

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-02T07:53:53Z

At 11:48 PM -0500 12/1/08, Ajai Khattri wrote:

>My personal opinion is that programmers should know more than just
>programming.

Crap!

I have enough to keep up with as it is.

Cheers,

tedd
--
-------
http://sperling.com http://ancientstones.com http://earthstones.com
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

how to correct wrong mysql datetime columns?

2008-12-02T07:45:46Z

This isn't necessarily PHP but... close enough? You could script a solution in PHP and indeed I might.

I had two CentOS servers' date info somehow go bad over the weekend. When I came back to work they thought it was 1993, wreaking havoc with the PHP/MySQL application hosted thereon. I restarted ntpd and they are now apparently doing fine, thanks. But I have some tables where the record creation date is saved using MySQL's now(). There are now some rows with the wrong value in this field and I am not quite clever enough to see the best way to fix.

The last output I have from the 'date' command before it was corrected is Wed Mar 3 18:40:05 EST 1993. When we got back to the present, 'date' said Tue Dec 2 09:20:05 EST 2008. Should I convert both to Unix timestamps, subtract the smaller from the larger and add that number of seconds to the values that I know are wrong? btw I know this number won't be exact but close enough will do, there being no alternative AFAIK.

Gratefully,

--
David Mintz
http://davidmintz.org/

The subtle source is clear and bright
The tributary streams flow through the darkness

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-02T04:07:21Z

Tim Lieberman wrote:

> 2) Keep anything sensitive out of the web root.
>
> So, very simplified, you've got something like this:
>
> /some/dir/webroot -- webroot
> /some/dir/secure -- not accessible by apache
> /some/dir/lib/db.php - php script that contains any sensitive database
> connection information (note: your database shouldn't be accepting
> connections from just anyone, either. That's why there's a "host" field
> in mysql.user.

Thanks for the interesting post. I was initially confused by one thing:
> /some/dir/lib/db.php - php script that contains any sensitive database

I was always under the impression as that Apache/PHP cannot access scripts
outside of webroot, which after some further thought appears to be only
applicable to script files that are directly accessed (such as the page.php
script in the original post). The script file with the db access information
is not to be served up under any circumstances and it is also not necessary as
Apache/PHP can access the local file system and read/write from/to any place
the access restrictions allow.
This way the sensitive information is off-limits via the web and technically
all that is needed in webroot is a single script file that only calls at least
one other script that is located somewhere else outside of webroot. Sometimes
the most difficult things are really darn easy.

David
_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-01T21:47:59Z

http://tinyurl.com/5ux4q6

On Tue, Dec 2, 2008 at 12:14 AM, Tim Lieberman <tim_lists@...> wrote:

On Dec 1, 2008, at 11:38 PM, Michele Waldman wrote:

Thanks to your soft, delicate input, I've been doing a little more research.

I was ps -ef on the linux server. Php appears to be configured into the
server and the process goes down due to misconfiguration, is it not the same
process handling the htaccess? Does that mean basically all web services
have stopped on the server and not even htaccess would protect it, leaving
the entire server vulnerable? Or will htaccess still be working?

You're still operating under the impression that something went wrong with the software.

Nothing went wrong with the software. The software worked exactly as it was supposed to. The problem was that it was misconfigured. (Unless there really is some bug in apache that nobody here has ever seen/verified). So, Garbage In (Configuration), Garbage (or, your source files, in this case) Out.

Even that facebook story ends up saying:

"After looking at every possible angle, I was unable to configure our Apache build to serve source code even if we wanted to. What we eventually found was a single server running a standard distribution build of Apache in our production pool of several thousand web severs. A lot has been posted online blaming PHP for this, however, the server that we eventually found was not running PHP."

http://sizzo.org/wp/2007/09/youre-source-code-is-showing

He goes on to suggest the same thing I did in my last message.

So, if this is a misconfiguration issue, that means if you don't have a sys
admin, that the programmer needs to learn the configuration and ensure it's
correct on the server?

If you rely on a server to deploy your applications you should do one of two things:

1) Know enough about server administration/configuration
2) Pay someone (or some organization) that does.

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-01T21:14:28Z

On Dec 1, 2008, at 11:38 PM, Michele Waldman wrote:

> Thanks to your soft, delicate input, I've been doing a little more
> research.
>
> I was ps -ef on the linux server. Php appears to be configured into
> the
> server and the process goes down due to misconfiguration, is it not
> the same
> process handling the htaccess? Does that mean basically all web
> services
> have stopped on the server and not even htaccess would protect it,
> leaving
> the entire server vulnerable? Or will htaccess still be working?

You're still operating under the impression that something went wrong
with the software.

Nothing went wrong with the software. The software worked exactly as
it was supposed to. The problem was that it was misconfigured.
(Unless there really is some bug in apache that nobody here has ever
seen/verified). So, Garbage In (Configuration), Garbage (or, your
source files, in this case) Out.

Even that facebook story ends up saying:

"After looking at every possible angle, I was unable to configure our
Apache build to serve source code even if we wanted to. What we
eventually found was a single server running a standard distribution
build of Apache in our production pool of several thousand web severs.
A lot has been posted online blaming PHP for this, however, the server
that we eventually found was not running PHP."

http://sizzo.org/wp/2007/09/youre-source-code-is-showing

He goes on to suggest the same thing I did in my last message.

> So, if this is a misconfiguration issue, that means if you don't
> have a sys
> admin, that the programmer needs to learn the configuration and
> ensure it's
> correct on the server?

If you rely on a server to deploy your applications you should do one
of two things:

1) Know enough about server administration/configuration
2) Pay someone (or some organization) that does.

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Need Joomla 1.5 book recommendation for Webmasters

2008-12-01T20:53:11Z

It's a follow-up not a review. If people are interested, I will ask
the Webmaster I turned these two books over to for comments after
allowing enough time to get familiar with them.

If anyone knows of other Joomla resources that are good for Webmasters
please let us know. Thanks!

David Roth

----------
:)

Is that your review or someone elses?

Barrie

On Mon, Dec 1, 2008 at 7:38 PM, David A. Roth <davidalanroth at gmail.com>wrote:

> Now I read this. :-)
>
> To follow-up my own postings. I'm like most of us, I tell people about
> Joomla and then would like to turn over good resources to them so they can
> get going on their own. I decided to explore two Joomla books for
> recommendations to Webmasters. One is the Visual Quickstart Guide Joomla! by
> Marni Derr and Tanya Symes published by Peachpit, and the second one is
> Joomla! A User's Guide by Barrie M. North published by Prentice Hall. Both
> of these books arrived today so I've not been able to examine them closely
> yet, but I did skim through them. North's book in Chapter 11 titled,
> "Creating a Restaurant Site for Joomla!" looks like an excellent guide for a
> Webmaster. I also like the areas called "The Least You Need to Know" which
> is exactly what a Webmaster is looking for. Before anyone gets huffy about
> the job title of Webmaster, I am referring to those who are not programmer
> types but have responsibility to control content on a web site. The Visual
> Quickstart Guide Joomla! is what the name implies as the rest of the Visual
> Quickstart series where there are many screen shots with text next to them
> briefly explaining each item such as a parameter.
>
> I'm going to turn these two books over to a Webmaster and see how they do
> and what is found to be most useful. It might be the combination of these
> two books or merely specific sections from each. I've professionally
> enjoyed the work of Barrie North and dig his newsletters and web site.
> However, I am looking for Joomla resources for Webmasters as I defined above
> since like all of us I want to see Joomla continue to grow and one way is
> for the Webmasters to be sold on it. I had a Webmaster search Amazon.com and
> come up with these two books independently of my influence.
>
>
> David Roth

_______________________________________________
New York PHP SIG: Joomla! Mailing List
http://lists.nyphp.org/mailman/listinfo/joomla

NYPHPCon 2006 Presentations Online
http://www.nyphpcon.com

Show Your Participation in New York PHP
http://www.nyphp.org/show_participation.php

From forum: NYPHP SIG: Joomla

Re: Htaccess and php user account

2008-12-01T20:48:07Z

On Mon, 1 Dec 2008, Michele Waldman wrote:

> server and the process goes down due to misconfiguration, is it not the same
> process handling the htaccess? Does that mean basically all web services
> have stopped on the server and not even htaccess would protect it, leaving
> the entire server vulnerable? Or will htaccess still be working?

mod_auth_mysql *is* an Apache module.

> So, if this is a misconfiguration issue, that means if you don't have a sys
> admin, that the programmer needs to learn the configuration and ensure it's
> correct on the server?

My personal opinion is that programmers should know more than just
programming.

--
Aj.

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-01T20:38:12Z

Thanks to your soft, delicate input, I've been doing a little more research.

I was ps -ef on the linux server. Php appears to be configured into the
server and the process goes down due to misconfiguration, is it not the same
process handling the htaccess? Does that mean basically all web services
have stopped on the server and not even htaccess would protect it, leaving
the entire server vulnerable? Or will htaccess still be working?

So, if this is a misconfiguration issue, that means if you don't have a sys
admin, that the programmer needs to learn the configuration and ensure it's
correct on the server?

-----Original Message-----
From: talk-bounces@... [mailto:talk-bounces@...] On
Behalf Of Chris Shiflett
Sent: Monday, December 01, 2008 11:29 PM
To: NYPHP Talk
Subject: Re: [nyphp-talk] Htaccess and php user account

On Dec 1, 2008, at 22:30, Hans Zaunere wrote:

>> If what you experienced is a common occurrence with mod_php, I hope
>> others on this list will chime in. If it is I'm going to cease using
>> apache and mod_php in production environments.
>
> This has nothing to do with mod_php/Apache that I've ever seen.
> It's a
> configuration issue.

Which reminds me, Brian Shire has a patch specifically to protect
against this:

http://tekrat.com/apache/ap_source_defense/

--
Chris Shiflett
http://shiflett.org/

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-01T20:28:44Z

On Dec 1, 2008, at 22:30, Hans Zaunere wrote:

>> If what you experienced is a common occurrence with mod_php, I hope
>> others on this list will chime in. If it is I'm going to cease using
>> apache and mod_php in production environments.
>
> This has nothing to do with mod_php/Apache that I've ever seen.
> It's a
> configuration issue.

Which reminds me, Brian Shire has a patch specifically to protect
against this:

http://tekrat.com/apache/ap_source_defense/

--
Chris Shiflett
http://shiflett.org/

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-01T20:19:44Z

Following up on my previous, more general post.

If you're just using PHP to control access to html content, and you're
worried that your shared host is going to bork your apache
configuration (which clearly is what happened in your case, assuming
apache), you basically do the following:

1) Do a typical PHP auth setup of whatever design. User accounts in
mysql, with md5'd passwords.
2) Keep anything sensitive out of the web root.

So, very simplified, you've got something like this:

/some/dir/webroot -- webroot
/some/dir/secure -- not accessible by apache
/some/dir/lib/db.php - php script that contains any sensitive database
connection information (note: your database shouldn't be accepting
connections from just anyone, either. That's why there's a "host"
field in mysql.user.
/some/dir/webroot/page.php might look like:

<?PHP
// make sure the user has authenticated.
if (! auth() ){
header("Location: login.php");
exit();
}

//include the protected content
include "../lib/page.html";
?>

So even if your apache config goes south and spits out PHP code, all
anyone sees is the content of page.php, above.

Exercise: Find the vulnerability in page.php that anyone can exploit.
It must be useful. The fact that there's a "lib" directory above the
webroot is not really something that needs to be a secret.

Many PHP frameworks out there (cake and zend come to mind) use exactly
this approach.

-Tim

/some/dir/webroot/page.php
On Dec 1, 2008, at 8:14 PM, Michele Waldman wrote:

> I’m trying to set up a user account with htaccess and mysql.
>
> But the shared hosting account doesn’t have mod_auth_mysql htaccess
> module installed on the machines and I can’t get root access.
>
> How else are folks implementing accounts?
>
> In php?
>
> If so, what’s the best general way to implement that. Do you use
> session variables for that?
>
> My primary concern about implementing accounts in php is that php
> can stop running on the server. If that happens, the security
> becomes non-existent. Plus, the php code can be dumped right to the
> browser.
>
> I’d much rather server level security than in processes that can stop.
>
> Thoughts on account security approaches, please.
>
> Michele
> _______________________________________________
> New York PHP User Group Community Talk Mailing List
> http://lists.nyphp.org/mailman/listinfo/talk
>
> http://www.nyphp.org/show_participation.php

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk

Re: Htaccess and php user account

2008-12-01T20:08:51Z

More generally, your top-level scripts getting dumped to the browser
should not be a security issue to begin with.

If one is concerned that access to source makes something insecure,
then they have no business using an open-source web server (like
apache!). I mean, anyone can just go grab all the source code! The
sky is surely falling!

-Tim

_______________________________________________
New York PHP User Group Community Talk Mailing List
http://lists.nyphp.org/mailman/listinfo/talk

http://www.nyphp.org/show_participation.php

From forum: NYPHP-Talk