Jonathan Snook's Blog: Password Protecting Admin Functions in CakePHP
496117
Jonathan Snook has posted a helpful trick for CakePHP users out there looking to secure sections of their site away from "normal users" and keep it only in the hands of the admins.   I just wanted to document this for easy future reference but if you don't want to hook up a complex user adminstration with authorization components, you can simply specify that the admin path be password protected in either your .htaccess file or in your httpd.conf.   This method is actually one of the built-in methods Apache has for restricting access (http authentication) that he's placed on his "/admin" directory. Call htpasswd to create the password file and you're all set to go.
258354
Over on alan@akbkhome.com's weblog, there's a new posting that just might cause a little stir among the PHP users looking forward to PDO becoming a part of PHP's core system, and why it's a bad idea.
414301
Over on the ThinkingPHP Blog, Felix Geisendorfer has completed his series of Ten Days of Free Dessert with some useful tips about using the CakePHP Framework.   'm announcing the "10 Days of free Dessert!". This basically means that I'll post at least 1 useful and easy to adapt CakePHP tip begining tomorrow for the next 10 days. I will try to pick things you might not have heard before and that didn't get a lot of loving from the docs team so far.   Here's the listing:  The 7 Crucials of CRUD Become Friends with the Inflector Generate a Random Password Keep Your Cake Fresh (use SVN HEAD) Keep a Custom Configuration File MySQL & UTF-8 Conventions over Ego Render Custom Errors Graceful Error Handling Default Models, Components, and Helpers  Each of the posts contains a description of the feature and some code to show how it's done. It's a great, handy little series of posts for any CakePHP developer to keep in their toolkit to pull from later on.
744440
On his blog today, Chris Hartjes has a quick screencast he's created showing off an interactive testing console he's worked up for use with the CakePHP framework.   I had suggested in an email to the CakePHP mailing list that an interactive console for doing testing of Models would be good. While at php|tek I spent a lot of time with the CakePHP guys talking about this. Out of it came some more ideas (like the ability to test your routes) and they even implemented a console that spits out API information for you. Very cool stuff. So, I decided to do a little screencast demo of a very early alpha version of the interactive console.   The screencast shows Chris running a test on his own classes, including demonstrating the built-in help the app offers.
310656
Popular posts from PHPDeveloper.org for the past week:IBM developerWorks: PHP frameworks, Part 1: Getting started with three popular frameworksWeb Development Blog: Tutorial: FTP Upload via cURLJoey's Blog: 8 Practical PHP Regular ExpressionsJeff Moore's Blog: Keywords and Language SimplicityAlessandro Crugnola's Blog: AMFPHP and mbstringTravis Swicegood's Blog: Why Inheritance SucksStefan Mischook's Blog: Creating Custom PHP Functions Video Tutorial - Part 3Johannes SchlÃ¼ter's Blog: PHP 5.3 UpdateInternet Super Hero Blog: mysqlnd to support PDO, mysqlnd in PHP 5.3Jacob Santos' Blog: Object Oriented Programming Isn't Easy
94330
On the Zend Developer Zone, there's a new tutorial covering the use of the Zend_Acl and Zend_Auth modules in the Zend Framework to create a simple user login and authentication system from Simon Mundy.   After submitting the initial example of how Zend_Auth and Zend_Acl could be implemented Gavin pointed out areas that weren't really addressed in my proof of concept and it could potentially confuse newcomers to the way MVC is utilised. I'd like to clarify that post to a) Address those concerns and b) see if there's any constructive criticism of the process that could benefit everyone.   He sets up the site layout (including where the actions lie) and defines some of the access rules the script will follow. From there, he creates a bootstrap file and an index.php to work with it. On top of this, he builds the key piece - the Auth.php - to handle the validation of the users.
636915
Popular posts from PHPDeveloper.org for the past week:RefreshinglyBlue Blog: PHP vs Ruby - Practical Language DifferencesAndreas Gohr's Blog: Determine StumbleUpon RankingsPHP.net: PHP 5.2.4 ReleasedThe Bakery: Five New Posts - Custom Views, CSS, ViewInFile, ActsAs and Email ValidationPHPBuilder.com: File uploads made easyStefan Mischook's Blog: Turning on display_errors in WAMP - Video Tutorialphp|architect: Pro::PHP Podcast - Newscast for August 2007MT-Soft Blog: Creating a secure PHP production environment from Source CodeCommunity News: Andi Gutmans to Present at AjaxWorld 2007HowTo Forge: How To Set Up A Facebook RSS Feed Reader
385236
Scott Mattocks is back with the latest installment of the PHP-GTK news, issue number 22.   It's been a while, but I finally have some time to get back to summing up the world of PHP-GTK. Things have slowed down a little in the past few months on the development side but that doesn't mean that the world of PHP-GTK 2 has stood still.   In this edition, there's a call for help for anyone that would want to join the other (4!) developers in working on the PHP-GTK 2 project as well as some general information about the project and its involvement in the community - from talks at php/db|works, International PHP Conference, and the Zend/PHP Conference to the many PHP-GTK-related articles being printed to a new online resource for PHP-GTK tutorials.
458071
In his latest blog post, Chris Shiflett talks about CakePHP "visiting" New York at this month's NYPHP meeting as well of some of his impressions on the framework.    Last night at the monthly NYPHP meeting, Nate Abele presented an introduction to CakePHP, a web application framework. The New York subway wasn't cooperating with my schedule, and due to a problem affecting all uptown 4/5 trains, I was 30 minutes late to the talk.   Here are some of my notes from the talk as well as the conversation we had over dinner and drinks later.    He wonders about if the fact that Cake supports PHP4 hinders it, the scaffolding available, Ajax functionality, and, of course, some of the security features of the framework. He notes that "as long as you stick to the Cake way of generating output, it handles the escaping for you" - definitely a plus.
357182
In a new post to his blog, Chris Hartjes, spurred on by an article in the latest edition of php|architect magazine (covering protecting your code), has shared a few opinions starting with a certain paragraph near the end.   To start, I will focus on the paragraph above. What I get out of that is that if only your source was closed and hidden from prying eyes, it would not have bugs in it. Which is, of course, total nonsense. Code has bugs because it's open and they feel safer? There are two kinds of bugs: application bugs (which is the code I would write) and system bugs (in this case, bugs that that appear from PHP itself). I'm sorry, but there is nothing I can do if there is a bug in PHP that causes my application to crash except to point this bug out to the people who have the ability to fix it.   He goes on to talk more about how protection like this (the article talks about using the IonCube Encoder) will not stop someone if they're really determine to get at the code underneath the encryption. His only suggestion is to make an application good enough that people wouldn't want to try to steal it as much and would rather pay for their version.   Encode your stuff if you want, but be aware that the minute you choose to do that you are telling your customers "I don't trust you" and I have a hard time understanding a business model that assumes people are going to want to steal the stuff you sell.
247721
Continuing on from this previous post talking about Javascript in CakePHP applications, Felix Geisendorfer hands out more tips in this new blog entry targeted mainly at users of the jQuery Javascript library.   While the old solution was nice to manage the JS of a smaller application, this one is ment to structure your JS even in bigger projects. To make this possible I decided to go with a loose (MV)C pattern.   He gives an example of using a SiteController in connection with a CalendarController to help populate the information for the calendar.
325308
This week's edition of PHP Magazine's PHPBarnstormer has been released - Issue #22.
755990
This new post on the Sanisoft blog has some good news for CakePHP developers concerning the bundled email component - it now can be made header injection safe.   In Cheesecake 1.x we had used our home grown component for sending emails. Having learned our lessons from the headaches of Pixelpost team due to email header injection attacks in their comment mailing code we had taken precautions to make our code safe from such attacks.   They proposed an update to the CakePHP functionality to integrate this solution on a more permanent basis.
642167
Newly posted over on PHP Magazine's website is this week's latest PHPBarnstormer - Issue #11
194115
On the PHP Security Blog, there's three new posts that Stefan Esser has written up that demonstrate some of the more destructive uses of Javascript that he's found:  JavaScript/HTML Portscanning and HTTP Auth Bruteforcing HTTP Auth in Firefox with JavaScript JavaScript Scanning and expose_php=On    While the first two are interesting, it's the last of these that most directly applies to PHP. He gives a simple "proof of concept" that checks to see if the embedded image is the correct "size" to be related to a webserver running PHP with the expose_php setting set to "on".
698334
Popular posts from PHPDeveloper.org for the past week:The Bakery: Six New Articles/Tutorials PostedEvert Pot's Blog: PHP: Arrays vs. ObjectsDevArticles: Learning AJAXInternet Super Hero: PHP: mysqli_fetch_all()David Coallier's Blog: PHP Namespaces (Part 1: Basic usage & gotchas)I/O Reader: 15 Cool Things & 12 Things to Dislike About PHPProPHP Podcast: Newscast - August 16, 2007PHPBuilder.com: Dynamic XML with PHPSite News: Popular Posts for the Week of 08.17.2007PRADO Watch Blog: PRADO Watch: Interview With Timani Tunduwani - Why I Moved From CakePHP to PRADO
267028
In the new blog entry, Jonathan Snook shows how to implement "conditional content" on your CakePHP application.   I finally got around to implementing conditional content here on Snook.ca. I've wanted to do this since I moved to the new design just over a month and a half ago. [...] With a little bit of late night development and some quick help from Larry (aka PhpNut, the lead developer of CakePHP), I've developed what I have dubbed "Elemental".   In his example he shows the two parts making up the functionality - the controller with new methods (in app_controller.php) and a new helper called "Elemental". Using the methods enableElement and disableElement you can turn off and on different chunks of code that are stored in an element array.