PHP Security Best Practices

Posted on 2019-08-05 [Monday] by jj5

I found an interesting article: Linux 25 PHP Security Best Practices For Sys Admins

php -d xdebug.profiler_enable=1

Posted on 2019-08-04 [Sunday] by jj5

So to enable profiling on the command line run your script in PHP like this:

php -d xdebug.profiler_enable=1 /path/to/script.php

You need to have configured xdebug in php.ini, I do it with a file in /etc/php/7.2/cli/conf.d/xdebug.ini that looks like this:

;xdebug.profiler_enable = 0
xdebug.profiler_output_dir = "/tmp/xdebug"
xdebug.profiler_output_name = "cachegrind.out.%p"

Note: you can enable profiling for all scripts with xdebug.profiler_enable = 1

Announcing numformat.php

Posted on 2019-06-02 [Sunday] by jj5

So I was reading output from

/proc/spl/kstat/zfs/arcstats

and I couldn’t read it easily because the numbers weren’t formatted with thousands separators and I figured I could fix that…

I give you numformat.php. It automatically reformats any input that looks like a number…

There’s more info on the programming@progclub mailing list.

NetBeans PHP “Invalid include path”

Posted on 2017-04-29 [Saturday] by jj5

So I migrated my projects from a Debian 8 (Jessie) system to a Debian 9 (Stretch) system. The default NetBeans installed by apt-get install netbeans on Strech was 8.1, and it didn’t include PHP support, so I manually installed NetBeans 8.2.

When I opened my old projects I got an error about an invalid global PHP include path.

So initially I edited ~/.netbeans/8.2/build.properties to change the php.global.include.path settings (to remove /usr/share/php5, because in Stretch I’m running PHP 7.0). But that didn’t work. Each time I ran NetBeans the build.properties file was overwritten with the old php5 directory.

So then I found ~/.netbeans/8.2/config/Preferences/org/netbeans/modules/php/project/general.properties. In there I edited the phpGlobalIncludPath and removed the /usr/share/php5 directory.

Then when I reopened NetBeans all of my projects opened properly without an error! Everything is easy when you know how!

Navigate to matching brace in NetBeans

Posted on 2017-03-10 [Friday] by jj5

So I wanted to know the keyboard shortcut to navigate between matching braces in my PHP (and other) code in NetBeans. I’m running NetBeans 8.2. So I searched and found General Editor Features which said “to find a shortcut for a specific command, type the command name in the Search field.” So the Search field they’re talking about is on the Keymap screen under Tools -> Options. After creating myself a custom Keymap Profile based on the NetBeans default settings I searched in the ‘Search:’ box for ‘match’ and found ‘Insertion Point to Matching Brace’ which is Ctrl+OPEN_BRACKET. Everything is easy when you know how!

Fixing curl SSL certificate problem

Posted on 2017-02-21 [Tuesday] by jj5

So I was having an issue with curl (actually the PHP client at first, but also with the command-line version).

The issue manifested like this:

jj5@orac:~/temp/curl$ curl https://test.jj5.net/my-file.txt
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

I ran the command in strace:

jj5@orac:~/temp/curl$ strace curl https://test.jj5.net/my-file.txt 2>&1 | less

Noticed this strace output:

stat("/etc/ssl/certs/8d28ae65.0", 0x7ffc33143630) = -1 ENOENT (No such file or directory)

There was no /etc/ssl/certs/8d28ae65.0 file.

I found a copy of 8d28ae65.0 here:

I made a copy of the cert here:

root@orac:/usr/local/share/ca-certificates# ll 8d28ae65.crt 
-rw-r--r-- 1 root staff 2.2K Feb 21 06:53 8d28ae65.crt

I checked what it had to say about itself:

root@orac:/usr/local/share/ca-certificates# openssl x509 -in 8d28ae65.crt -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            2b:2e:6e:ea:d9:75:36:6c:14:8a:6e:db:a3:7c:8c:07
    Signature Algorithm: sha384WithRSAEncryption
        Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Certification Authority
        Validity
            Not Before: Feb 12 00:00:00 2014 GMT
            Not After : Feb 11 23:59:59 2029 GMT
        Subject: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO RSA Domain Validation Secure Server CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:8e:c2:02:19:e1:a0:59:a4:eb:38:35:8d:2c:fd:
                    01:d0:d3:49:c0:64:c7:0b:62:05:45:16:3a:a8:a0:
                    c0:0c:02:7f:1d:cc:db:c4:a1:6d:77:03:a3:0f:86:
                    f9:e3:06:9c:3e:0b:81:8a:9b:49:1b:ad:03:be:fa:
                    4b:db:8c:20:ed:d5:ce:5e:65:8e:3e:0d:af:4c:c2:
                    b0:b7:45:5e:52:2f:34:de:48:24:64:b4:41:ae:00:
                    97:f7:be:67:de:9e:d0:7a:a7:53:80:3b:7c:ad:f5:
                    96:55:6f:97:47:0a:7c:85:8b:22:97:8d:b3:84:e0:
                    96:57:d0:70:18:60:96:8f:ee:2d:07:93:9d:a1:ba:
                    ca:d1:cd:7b:e9:c4:2a:9a:28:21:91:4d:6f:92:4f:
                    25:a5:f2:7a:35:dd:26:dc:46:a5:d0:ac:59:35:8c:
                    ff:4e:91:43:50:3f:59:93:1e:6c:51:21:ee:58:14:
                    ab:fe:75:50:78:3e:4c:b0:1c:86:13:fa:6b:98:bc:
                    e0:3b:94:1e:85:52:dc:03:93:24:18:6e:cb:27:51:
                    45:e6:70:de:25:43:a4:0d:e1:4a:a5:ed:b6:7e:c8:
                    cd:6d:ee:2e:1d:27:73:5d:dc:45:30:80:aa:e3:b2:
                    41:0b:af:bd:44:87:da:b9:e5:1b:9d:7f:ae:e5:85:
                    82:a5
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                keyid:BB:AF:7E:02:3D:FA:A6:F1:3C:84:8E:AD:EE:38:98:EC:D9:32:32:D4

            X509v3 Subject Key Identifier: 
                90:AF:6A:3A:94:5A:0B:D8:90:EA:12:56:73:DF:43:B4:3A:28:DA:E7
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Extended Key Usage: 
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Certificate Policies: 
                Policy: X509v3 Any Policy
                Policy: 2.23.140.1.2.1

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.comodoca.com/COMODORSACertificationAuthority.crl

            Authority Information Access: 
                CA Issuers - URI:http://crt.comodoca.com/COMODORSAAddTrustCA.crt
                OCSP - URI:http://ocsp.comodoca.com

    Signature Algorithm: sha384WithRSAEncryption
         4e:2b:76:4f:92:1c:62:36:89:ba:77:c1:27:05:f4:1c:d6:44:
         9d:a9:9a:3e:aa:d5:66:66:01:3e:ea:49:e6:a2:35:bc:fa:f6:
         dd:95:8e:99:35:98:0e:36:18:75:b1:dd:dd:50:72:7c:ae:dc:
         77:88:ce:0f:f7:90:20:ca:a3:67:2e:1f:56:7f:7b:e1:44:ea:
         42:95:c4:5d:0d:01:50:46:15:f2:81:89:59:6c:8a:dd:8c:f1:
         12:a1:8d:3a:42:8a:98:f8:4b:34:7b:27:3b:08:b4:6f:24:3b:
         72:9d:63:74:58:3c:1a:6c:3f:4f:c7:11:9a:c8:a8:f5:b5:37:
         ef:10:45:c6:6c:d9:e0:5e:95:26:b3:eb:ad:a3:b9:ee:7f:0c:
         9a:66:35:73:32:60:4e:e5:dd:8a:61:2c:6e:52:11:77:68:96:
         d3:18:75:51:15:00:1b:74:88:dd:e1:c7:38:04:43:28:e9:16:
         fd:d9:05:d4:5d:47:27:60:d6:fb:38:3b:6c:72:a2:94:f8:42:
         1a:df:ed:6f:06:8c:45:c2:06:00:aa:e4:e8:dc:d9:b5:e1:73:
         78:ec:f6:23:dc:d1:dd:6c:8e:1a:8f:a5:ea:54:7c:96:b7:c3:
         fe:55:8e:8d:49:5e:fc:64:bb:cf:3e:bd:96:eb:69:cd:bf:e0:
         48:f1:62:82:10:e5:0c:46:57:f2:33:da:d0:c8:63:ed:c6:1f:
         94:05:96:4a:1a:91:d1:f7:eb:cf:8f:52:ae:0d:08:d9:3e:a8:
         a0:51:e9:c1:87:74:d5:c9:f7:74:ab:2e:53:fb:bb:7a:fb:97:
         e2:f8:1f:26:8f:b3:d2:a0:e0:37:5b:28:3b:31:e5:0e:57:2d:
         5a:b8:ad:79:ac:5e:20:66:1a:a5:b9:a6:b5:39:c1:f5:98:43:
         ff:ee:f9:a7:a7:fd:ee:ca:24:3d:80:16:c4:17:8f:8a:c1:60:
         a1:0c:ae:5b:43:47:91:4b:d5:9a:17:5f:f9:d4:87:c1:c2:8c:
         b7:e7:e2:0f:30:19:37:86:ac:e0:dc:42:03:e6:94:a8:9d:ae:
         fd:0f:24:51:94:ce:92:08:d1:fc:50:f0:03:40:7b:88:59:ed:
         0e:dd:ac:d2:77:82:34:dc:06:95:02:d8:90:f9:2d:ea:37:d5:
         1a:60:d0:67:20:d7:d8:42:0b:45:af:82:68:de:dd:66:24:37:
         90:29:94:19:46:19:25:b8:80:d7:cb:d4:86:28:6a:44:70:26:
         23:62:a9:9f:86:6f:bf:ba:90:70:d2:56:77:85:78:ef:ea:25:
         a9:17:ce:50:72:8c:00:3a:aa:e3:db:63:34:9f:f8:06:71:01:
         e2:82:20:d4:fe:6f:bd:b1

Seems legit! :)

So I installed it:

root@orac:/usr/local/share/ca-certificates# update-ca-certificates

Bug fixed!

PDO: Execute a prepared statement using array for IN clause

Posted on 2016-12-18 [Sunday] by jj5

See Example #5 here.

/* Execute a prepared statement using an array of values for an IN clause */
$params = array(1, 21, 63, 171);
/* Create a string for the parameter placeholders filled to the number of params */
$place_holders = implode(',', array_fill(0, count($params), '?'));

/*
    This prepares the statement with enough unnamed placeholders for every value
    in our $params array. The values of the $params array are then bound to the
    placeholders in the prepared statement when the statement is executed.
    This is not the same thing as using PDOStatement::bindParam() since this
    requires a reference to the variable. PDOStatement::execute() only binds
    by value instead.
*/
$sth = $dbh->prepare("SELECT id, name FROM contacts WHERE id IN ($place_holders)");
$sth->execute($params);

PHP values

Posted on 2016-03-23 [Wednesday] by jj5

USA Time Zones in PHP

Posted on 2015-02-21 [Saturday] by jj5

See here for a list of US time zones.

Eastern ........... America/New_York
Central ........... America/Chicago
Mountain .......... America/Denver
Mountain no DST ... America/Phoenix
Pacific ........... America/Los_Angeles
Alaska ............ America/Anchorage
Hawaii ............ America/Adak
Hawaii no DST ..... Pacific/Honolulu

Xdebug trace != profile

Posted on 2014-12-21 [Sunday] by jj5

So it just took me all night to figure out that in Xdebug ‘tracing’ is different to ‘profiling’.

It didn’t help that the xdebug.trace_output_name included an example format of ‘cachegrind.out.%s’. Why would you name a trace file cachegrind.out if only profile files are in cachegrind format!?

In my efforts to get profiling to work I found myself loading trace files into KCachegrind and getting the rather unhelpful message: “Could not open the file “/run/shm/xdebug/trace…xt”. Check it exists and you have enough permissions to read it.”

So the error message is about file permissions. I checked and checked and checked again but the file permissions were OK. The problem was I was loading a trace file, not a profile file.

So I gave up on KCachegrind and tried to get webgrind to work. Turns out loading a trace file (not a profile file) into webgrind doesn’t work either. I got the same problem reported by Sven about ‘parsers is undefined’. I fucked around trying to update the jquery.tablesorter plugin in webgrind, but the problem was due to the fact I was loading a tracing file, not a profiling file.

In the end I got it all figured out. Here’s my /etc/php5/mods-enabled/xdebug.ini file:

zend_extension=/usr/lib/php5/20131226/xdebug.so
xdebug.remote_enable=1
xdebug.remote_handler=dbgp
xdebug.remote_mode=req
;xdebug.remote_host=127.0.0.1
xdebug.remote_host=10.1.1.203
;xdebug.remote_port=9000
xdebug.remote_port=9999

; http://www.xdebug.org/docs/all

xdebug.profiler_enable=1
xdebug.profiler_output_dir=/run/shm/xdebug
xdebug.profiler_output_name=cachegrind.out.%t.%R

xdebug.auto_trace=1
xdebug.collect_assignments=1
xdebug.collect_includes=1
xdebug.collect_params=4
xdebug.collect_return=1
xdebug.collect_vars=0
xdebug.show_mem_delta=1
;2 for HTML:
xdebug.trace_format=0
xdebug.trace_options=1
xdebug.trace_output_dir=/run/shm/xdebug
xdebug.trace_output_name=trace.%t.%R
xdebug.var_display_max_children=-1
xdebug.var_display_max_data=-1
xdebug.var_display_max_depth=-1

The above config supports generation of tracing files and profiling files. I can now load my profiling files into KCachegrind and webgrind.

Everything is easy when you know how!

ProgClub

…because every programmer needs a good club!

Tag Archives: php