My RSS » Planet PHP » May 13, 2010

Planet PHP

Application Builder slowly growing

Posted: May 13th, 2010, 9:16pm MDT by Alan Knowles

Article originally from AK BK Consulting blog

While paid work is still horribly quiet, my little application builder is getting closer to usable.
I posted a video a while back showing the web version of the Application builder, this is the next generation, a desktop version all done in Javascript using Seed. Not only can it build Roo applications, but also Gtk ones.. (and in theory maybe JQuery/Prototype etc..)
The main reason to switch to a desktop version was the addition of GtkSourceView, which will enable autocompletion and proper code editing.

It's really a proof of concept, but I can easily move it out to github from it's current home - [git.akbkhome.com] if anyone want's to help out.
download:
git clone [git.akbkhome.com]
run update.sh once download to get the roo library
Application Builder slowly growing

Posted: May 13th, 2010, 8:52pm MDT by Alan Knowles

Article originally from AK BK Consulting blog

While paid work is still horribly quiet, my little application builder is getting closer to usable.
I posted a video a while back showing the web version of the Application builder, this is the next generation, a desktop version all done in Javascript using Seed. Not only can it build Roo applications, but also Gtk ones.. (and in theory maybe JQuery/Prototype etc..)
The main reason to switch to a desktop version was the addition of GtkSourceView, which will enable autocompletion and proper code editing.

It's really a proof of concept, but I can easily move it out to github from it's current home - [git.akbkhome.com] if anyone want's to help out.
Book review: Expert PHP 5 Tools

Posted: May 13th, 2010, 8:01am MDT by Michelangelo van Dam

Two weeks ago I received a copy of Expert PHP 5 Tools with the request if I could review this book. Improving development processes using PHP tools is something I promote myself (see my slides about PHP Power Tools on Slideshare), so I could not refuse this request.

The book
Expert PHP 5 Tools is a new book from Packt Publishing written by Dirk Merkel. In 10 chapters Dirk introduces the reader with several PHP tools that will improve development processes and quality of code from a single developer or a team of developers. From simply syntax checking and code validation to automated testing and deploying, each chapter discusses each tool in detail and contains sample code to put the theory into practice.

Besides describing in detail tools to validate (PHPLint and PHP_CodeSniffer), test (PHPUnit), debug (XDebug) and manage PHP codebases (Subversion) and improve collaboration between developers, Dirk has dedicated a whole chapter on using UML to describe and structure your applications, a whole chapter on using Eclipse IDE with the PHP Development Tools (PDT) and continuous integration with Cruise Control and PHPUnderControl using both Ant as Phing to continuous build and deploy your PHP projects.

I must say I was impressed by the detailed description of each tool and how Dirk used simple examples in order to show the reader how to use the tool in the best possible manner. I found this book an easy read since I already had experience with the tools Dirk describes in the book, but even if I had not yet worked with them, the examples he has given in each chapter are of great value and give the reader a good insight in what each tool does and how it responds.

Conclusion
With PHP becoming increasingly important as a technology within corporate application development and enterprise development structures, using automated tools to improve quality have become very important for many developers.

Expert PHP 5 Tools is a must-read book for every PHP developer involved in professional PHP application development and wants to improve the quality of his work. Also for PHP development teams, this book will convince the reader why it's important to focus on coding standards, unit testing, automated documentation and even automated builds to structure each step in an automated, repetitive way.
Article: Decoding a User Space Encoded PHP Script

Posted: May 13th, 2010, 6:01am MDT by Month of PHP Security

Today we present you a short article about how to decode a PHP file encoded with the php-crypt.com PHP encoder. This article was written today by Stefan Esser after having seen an advertisement for php-crypt in the Xing PHP Development Forum.
Decoding a User Space Encoded PHP Script
Stefan Esser, 2010-05-13
Introduction
Every once in a while a new PHP encryption tool/service pops up and offers PHP “encryption”. Therefore the idea behind php-crypt that was announced today in the PHP Development forum of Xing is nothing new. Infact there are two types of PHP encryption systems source code obfuscators/encryptors/encoders and bytecode obfuscators/encryptors/encoders. The first type is usually implemented in PHP user space and the second type requires a PHP extension written in C/C++ that hooks into the Zend Engine and provides an encryption of the executed Zend Engine bytecode.

PHP-Crypt is one of the type one obfuscators/encryptors/encoders that is implemented in PHP user space only. Because I have yet to see a user space PHP encoding tool that is hard to break I took a quick look into it and present my results here in order to show how useless this type of encrypters is usually.
The encrypted Code
In order to play around with the crypter I wrote a very simple Hello World script in PHP and let it be encoded by the demo version of the php-crypt online encoder.
<?php
echo 'Hello World';
?>
The resulting encoded PHP script looks like this.
<?php
/* Demo by www.php-crypt.com - Simple Script */
$keystroke1 = base64_decode("d2RyMTU5c3E0YXllejd4Y2duZl90djhubHVrNmpoYmlvMzJtcA==");
eval(gzinflate(base64_decode('hY69DsIgFIVf5QwMENGUuWH0QZTeKrFekgsMxvTdLWlqTBfX8/uNlUOJiSGpEIc0kFa5SOSbVZdnqlwM3lAPesEj1+vifQPoLJzpEUe9KBPx5hjvXasJlSqMcBedZNBtxeCAbbjHDJoy/U/i1PjOK9+ewlns7o/O2N+X+QM=')));
$O0O0O0O0O0O0=$keystroke1[2].$keystroke1[32].$keystroke1[20].$keystroke1[11].$keystroke1[23].$keystroke1
Truncated by Planet PHP, read more at the original (another 31277 bytes)
MOPS-2010-023: Cacti Graph Viewer SQL Injection Vulnerability

Posted: May 13th, 2010, 3:22am MDT by Month of PHP Security

An SQL Injection vulnerability was discovered in Cacti that allows to retrieve all data from the database. In Cacti installations with publicly viewable graphs this vulnerability is a pre-auth SQL injection vulnerability.
Affected versions
Affected is Cacti <= 0.8.7e
Risk
High.
Credits
The vulnerability was discovered by Stefan Esser as part of the SQL Injection Marathon.
About Cacti
Cacti is a complete network graphing solution designed to harness the power of RRDTool’s data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices.
Detailed information
This vulnerability was discovered during SQL Injection Marathon a PHP code auditing marathon performed by Stefan Esser. The basic idea of this initiative is to select random PHP applications and perform a short code audit on them. The maximum time spent on each application is 30 minutes and after the first found SQL injection usually the next application is audited.

During SQL Injection Marathon Cacti was also audited and due to previous knowledge about the source code structure it was possible to find a SQL injection vulnerability caused by wrong variable filtering in less than 30 minutes. The offending code is located in graph.php which is depending on the configuration accessible by all.
case 'zoom':
/* find the maximum time span a graph can show */
$max_timespan=1;
if (sizeof($rras) > 0) {
foreach ($rras as $rra) {
if ($rra["steps"] * $rra["rows"] * $rra["rrd_step"] > $max_timespan) {
$max_timespan = $rra["steps"] * $rra["rows"] * $rra["rrd_step"];
"/>
Truncated by Planet PHP, read more at the original (another 10111 bytes)
Podcast Lately in PHP - Episode 1

Posted: May 13th, 2010, 2:32am MDT by PHP Classes

Podcast Lately in PHP - Episode 1 By Manuel Lemos This is the inaugural episode of the Lately in PHP podcast hosted by Manuel Lemos and Ernani Joppert. It covers some of the latest happenings in the PHP world.

This episode covers the top active PHP user groups, interview with Guilherme Blanco of the Doctrine project, finding and posting great PHP jobs, Yahoo Hack Day event, the Yahoo Query Language, Google Developer Day event, the winners of the PHP Programming Innovation Award edition of March 2010, the article about PHP developers switching from Internet Explorer and Firefox to Google Chrome, and the plans for Firefox 4.
Change!

Posted: May 13th, 2010, 12:59am MDT by PHP 10.0 Blog

On Monday was my first day on a new job.
After 10+ year with Zend, I have decided that I need to change direction somewhat and do something a bit different. I was not easy to leave Zend, after so long time and departing from such great company that Zend is – it was a hard decision. But I felt that’s what I need to do, and so it goes. I have accepted an architect position at SugarCRM and that’s where I work now.
I plan to stay with PHP of course and continue to contribute to PHP core and ZF, time permitting

P.S. Also, Simple Cloud API, on which I was working at Zend lately, has Technological Preview Release. Check it out!