PHP Security Blog: Open_basedir confusion
505235
Stefan Esser is trying to clear up some confusion in a new post to the PHP Security Blog today about his stand on enabling open_basedir on your PHP installation.   From time to time I get the question why I recommend enabling open_basedir and on the other hand call it a solution flawed by design. This is actually a good question, because the untrained PHP user might get a little bit confused about this and might believe that I change my opinion on a daily basis.   He talks about his reasoning - how it does it's job protecting PHP developers from being able to get to those file, but how it's also flawed with issues due to some 3rd party libraries that have their own problems.
646811
Ilia Alshanetsky has an announcement on his blog today about the release of the next candidate for the upcoming PHP 5.2 series - PHP 5.2.0RC5.    After 2 weeks of inaction 5.2.0 final release is finally in sight. A few minutes ago I've released the last (I mean it this time) release candidate of 5.2.0, RC5. If all goes well a week from now 5.2.0 final will be out ready for use. In the meantime I'd like to ask once again that everyone try this RC, which can downloaded from here.   I don't think you'd be able to find any major issues or regressions in this RC, but if you do certainly let me know, if necessary RC6 is not out of the question.    The more this new release is downloaded and tested, the faster we all get PHP 5.2 - so get out there and get testing!   The Windows builds have also already been created courtesy of Edin Kadribasic.
704716
As a part of their IRC discussion series, the PHP Thinktank Blog brings you the logs from their latest talk - Scott Mattocks on PHP-GTK.   Scott talked about what PHP-GTK is and what kind of things it can do as well as how you can run them on your own machine. There was also a sample link he gave out to show what an application might look like. He also talks about what sets PHP-GTK apart from the traditional PHP applications.   He gives a (very) small sample application as well as some explanations of some of the different components (widgets) that are included with the PHP-GTK installation. There's lots more where all this came from, so be sure to check out the whole talk log for more great PHP-GTK goodies.
703645
In a new post to the PHP Security Blog, Stefan Esser points out a recent commit to the PHP core as a fix to the session handling in PHP:   I just came back home and saw a very recent commit to PHP's session management. It is another attempt to fix the session cookie attribute injection that the PHP developers already tried to fix in PHP 5.2.3 without giving any credits. [...] their new fix that consists of blacklisting a bunch of legal characters from the session id, will most probably result in hundreds or thousands of broken sites.   Stefan points out that the fix blocks several valid characters that sites could potentially use in their session IDs, and that with this new code in place, it could drastically effect those site's functionality.   As of the time of this post, however, it seems that the issue has been recognized and corrected so as not to cause the above mentioned issue in future updates.
165658
Following up on yesterday's release of PHP 5.2.0 RC4 from Ilia, Edin Kadribasic has posted the corresponding Windows builds.   This build is featuring the new installer contributed by John Mertic so testing it before the final release would be appreciated.   He's linked to various packages:  php-5.2.0RC4-Win32.zip php-5.2.0RC4-win32-installer.msi pecl-5.2.0RC4-Win32.zip php-debug-pack-5.2.0RC4-Win32.zip
283708
Builder.com.au has a new article today about the recent image issue - the PHP code embedded inside the GIF - that's come up on several sites.   The exploit code slipped through the site's defenses with the aid of a legitimate image at the beginning of the file, according to a blog post on the Sans Institutes's Internet Storm Center. [...] Malicious attackers planted PHP coded exploit script within an image file. PHP is often used as a programming language to create dynamic Web sites.   The article reports that, while this exploit hasn't happened much, the occurrences of it's use are growing with victims in a wide range of classifications - from small personal sites out to a certain major image hosting site. This same issue was discussed here on the PHPClasses.org website as well.
495913
From the PEAR blog today comes a new post talking about the introduction of a much requested option when accessing the PEAR source code - SVN over CVS.   As part of the PEAR2 project we are making that happen. I'm happy to announce that we now have an SVN repo ready for testing. Web access at http://svn.pear.php.net with the SVN url being http://svn.pear.php.net/repo.   The access isn't quite available yet, but it will be as soon as they figure out how they want people to be able to access the parts of the PEAR2 source code. Keep an eye on the PEAR Blog for the latest.
115494
Richard Thomas comments on a "funny little PHP 'virus'" that he's noticed coming to him via emails:   Got an email that claimed to be from my host, it used a generic return address and talked about security upgrades and such and how due to new policy to help keep a secure data center I was required to upload and run 1 of 2 files in a zip attachment, the first was a php file the other was an asp file.   Of course, it wasn't from the host, so he investigated a little further to find out exactly what was going on with the file. Basically, it was a modified nsTView file with some added emailing and password discovery code. The code was "hidden" though - through a base64_encode call on one side and then decoded it on the other to cause the server to execute the code. He even posts and example of what the base64ed code might look like.
611971
Although frankly I really didn't feel the need to read the entire thread, I can tell you that the posting to the PHP 3 mailing list is related to the Smarty Templating Engine back in the day. In fact, I believe this was the original spec Andrei proposed before Smarty even existed. Although I don't remember the exact e-mail, this posting reminded me that there was a point in time I thought exactly this way... quoting myself:
295577
Popular posts from PHPDeveloper.org for the past week:PHPBuilder.com: Fundamentals of PHP SuperglobalsGareth Heyes' Blog: Regular expression challengeAnyExample.com: Downloading files from Amazon S3Travis Swicegood's Blog: PHPT: A teaser...Nessa's Blog: Using PHP to Display Version Info (I and II)Laura Thomson's Blog: On Open Source: PHP Video PodcastSitePoint PHP Blog: Dynamic global functions in PHPJosh Sharp's Blog: Why you should be using a frameworkDerick Rethans' Blog: XDebug 2.0.1Tobias Schlitt's Blog: At IPC2k7: WebDAV will come over you...
23541
This week's latest PHPBarnstormer has been posted.
660571
DevShed is starting up a new series this morning with this new tutorial, part one in the creation of a simple blogging system using PHP and MySQL.   In this three-part tutorial we are going to be creating an open blogging system. We are also going to provide scripts that will make it possible to switch to a closed blogging system. This article, which is the first part, will cover the creation of the login scripts for a closed system.   They start with a definition, the difference between an open blogging system and a closed one (if users have to register or not). They start with the creation of the database to store the users in followed by the PHP code for the simple login page. It uses sessions to keep track of which user is logged in. Of course, where there's a log in, there needs to be a log out and they give the simple code for that. Finally, they include a "forgot your password" script to help users when they can't remember the info they'd signed up with.
139275
Popular posts from PHPDeveloper.org for the past week:PHP-Coding-Practices.com: Try-Catch Syntax WeirdnessPHPBuilder.com: Cross-Platform Database PHP DevelopmentIBM developerWorks: Java and PHP technology on AIX - Integrate the Java business application w/ DB2OpenSourceCommunity.org: What do you think makes a good CMS?Jonathan Snook's Blog: Elemental: Conditional Content with CakePHPDevShed: The Basics of Using the Factory Pattern in PHP 5Builder.com.au: PHP exploit code plants itself in GIFJohn Cox's Blog:  Linux.com Now PHP PoweredNick Halstead's Blog: Solving Programming ProblemsPHP-Tools Blog: Testing FIT
179571
Here's what was popular in the PHP community one year ago today:Splitbrain.org: Add comments to any PHP scriptRyan Malesevich's Blog: Separate Trackbacks from Comments RevisitedDeveloperTutorials.com: Inserting An Array Into A DatabaseSymfony Blog: The Definitive Guide to Symfony and symfony 1.0 RC1 releasedSoledad Pendaes' Blog: PHP will never have a (real) Rails-like frameworkJSLabs Blog:  A web server in PHPRobert Swarthout's Blog: PHP frontend to Subversion (SVN)Christopher Jones' Blog: OCI8 1.2.3 Patch is Available on PECLDotVoid.com: Parsing the user agent string using PHPPaul Jones' Blog: Solar 0.26.0 Released, and New WebsitePierre-Alain Joye's Blog: Zip 1.8.5, small bug fixes releaseZend Developer Zone: Zend Monthly Newsletter - JanuaryMike Potter's Blog: Flash, Flex and PHP Just Got A Huge BoostJonathan Snook's Blog: Review: PHP SolutionsOracle Technology Network: Creating an Ajax Process Using PHP and Oracle
202255
OK, we had an extended breather from our last look at BIND's zone file pri.example.org. It's time to finish up and get a sense of what these records mean. To go off-topic a little, recently, I had the task of setting up two OpenLDAP servers and putting together a test environment for a project with several developers and several applications including some LAMP applications. Without a working knowledge of DNS, the project would have gone amuck.
636915
Popular posts from PHPDeveloper.org for the past week:RefreshinglyBlue Blog: PHP vs Ruby - Practical Language DifferencesAndreas Gohr's Blog: Determine StumbleUpon RankingsPHP.net: PHP 5.2.4 ReleasedThe Bakery: Five New Posts - Custom Views, CSS, ViewInFile, ActsAs and Email ValidationPHPBuilder.com: File uploads made easyStefan Mischook's Blog: Turning on display_errors in WAMP - Video Tutorialphp|architect: Pro::PHP Podcast - Newscast for August 2007MT-Soft Blog: Creating a secure PHP production environment from Source CodeCommunity News: Andi Gutmans to Present at AjaxWorld 2007HowTo Forge: How To Set Up A Facebook RSS Feed Reader
345464
php|architect has a new note about a few PHP vulnerabilities: