-
Posts
71 -
Joined
-
Last visited
Everything posted by mrjasongorman
-
Hi all, worked it out using a pen and paper haha, followed the code and wrote down the word it seemed to be spelling out from the random string at the top. The random string turned out to be not so random spelling out base64_decode.
- 9 replies
-
- 2
-
- infosec
- cybersecurity
-
(and 3 more)
Tagged with:
-
This isn't related to Processwire, but just so the PW community is aware, today we discovered several malicious files in our server (Wordpress environment). The code in the files ultimately allows for the same thing, remote code execution. I'm guessing some security hole allowed an attacker to execute code via a plugin, which wrote a file to www.example.com/dump.php This file contained the following code: http://pastebin.com/dsLZnbCW After deciphering it slightly: http://pastebin.com/NiCe9ftn I then realised it was looking for a post request variable "n59a097" Malicious code was then being sent base64 encoded to this post variable, where it was then being decoded and run through the eval() function. Digital Ocean alerted us of the issue, after our server had been reported to them for sending out spam email. Just a heads up really as to the possibility of security holes allowing simple files to be written, that then allow for remote code execution. I'm sure Processwire is far less a target than Wordpress for these types of exploits but keep an eye out.
- 9 replies
-
- 2
-
- infosec
- cybersecurity
-
(and 3 more)
Tagged with:
-
Just curious how does the selector engine generate it's SQL request?
-
Thanks for replying guys, i thought the reason for holding back might be something to do with the core. Looking forward to seeing the 3.x features!
-
I'm sure there may have been a topic talking about this previously, but ironically i couldn't find it when using the search box in the forum. Recently i've been using Processwire as more of a CMF really, which i've found it really easy to mould and shape to the application needs. The one thing that concerns me though is the fact it only uses the MyISAM DB Engine. These days InnoDB seems to be the standard, and seems to fit better with the way PW stores things, for example Foreign keys help the DB understand links of data across different tables (PW stores each field in a separate table). This would also benefit greatly from transactions, making sure that every SQL operation needed to store an item and its field data would either all be successful, or wouldn't happen at all. This gives guarantees that no data went missing during the save due to DB issues and crashes. Row locking (InnoDB) rather than Table Locking (MyISAM) is a huge advantage, take the situation where i want to save an item that has a common field, like field_body, if i understand it correctly, then the field_body table would be locked on every read as MyISAM uses table locking, so other queries to read or write would have to wait until the table lock is released. InnoDB on the other hand only locks the row in question so other operations can happen to the table at the same time. Another feature that goes along with the ACID compliance is The commit log, InnoDB keeps a commit log of transactions, so in the event of a crash it can recover to a consistent state. MYISAM however does not so it can be hard to know what state the data should be in, when recovering. I think i read previously that Ryan chose MyISAM at the time for it's Full text search capabilities, which InnoDB only introduced in MySQL 5.6, but i think unless full text search is the key part to the internal PW system, then is it really that necessary a trade off? I would rather the reliability of InnoDB storing data than to have full text search, for that kind of functionality i would use a separate system built for specifically with this feature, such as ElasticSearch. So i was wondering, will InnoDB become the default DB engine for PW ??
-
Great Topic, i come across this problem all the time. Wouldn't be such a big problem if ID's were truly unique. With ID's are being auto incremented separately (on development, and in production) it makes it hard to merge the two DB's without conflict. I tend to just make a note of fields / templates added and then go through the process manually on live. Bit of a pain.
-
Hey, yeah looks pretty good!
-
Hi all! this is more of a general MYSQL Schema discussion but i noticed that PW does a pretty good job of handling flexible objects (pages) by creating a new table for each object property (field). I was wondering what other options there are out there for storing flexible but efficient objects in MYSQL. I noticed that Wordpress uses it's wp_postmeta table extensively for storing flexible schema. Also according to Facebooks engineering there's a simplified schema overview of it's TAO based system that uses MYSQL as it's underlying datastore for it's graph data. (https://www.facebook.com/notes/facebook-engineering/tao-the-power-of-the-graph/10151525983993920) So as i say i was just curious really as to different setups and indexing options anyone has used to be able to handle flexible objects within MYSQL.
-
I checked the $config->httpHosts array and the correct addresses were listed in there. As a fix i've added $config->httpHost (singular) with the live address. But unfortunately this then makes working on localhost a bit of a pain.
-
If anyone can help with this that would be great. The password reset link is localhost? but i'm viewing the site from it's live url. Thanks, Jason
-
Cool, thanks for helping out!
-
Ah i see, so it just passes it in as an PW API query. I'm guessing the relevant functions are in the /wire folder?
-
I'm intrigued about how Processwire resolves URLS. I've been having a snoop around the database and found that each page has a "name" which looks to be it's section of a URL. The thing that's puzzling me is say a page is at this address example.com/mens/tshirts/product-name/ how does processwire process that URL? i understand it's easy enough to process just example.com/product-name/ that's just a simple database lookup, but how does it go about validating the position of that page in the database hierarchy with the hierarchy of the URL? I know that the web server is rewriting urls to /index.php?it=$uri&$args I noticed that Wordpress and other systems must use a similar technique. But how does Processwire manage to do this at such speed? Any help on how this works would be great
-
MarkupSimpleNavigation Menu order strange error
mrjasongorman replied to mrjasongorman's topic in General Support
Actually this did not quite work correctly i instead refactored the code to generate the array. From this $topMenu = $pages->find("id=1|1001|1025|1044|1035|1061|1043|1062, sort=sort"); to this: $root = $pages->get('/'); $topMenu = $root->children('id=1001|1025|1044|1035|1061|1043|1062'); $topMenu = $topMenu->prepend($root); -
MarkupSimpleNavigation Menu order strange error
mrjasongorman replied to mrjasongorman's topic in General Support
removing sort=sort seemed to fix the problem, i guess it automatically sorts by menu order. -
MarkupSimpleNavigation Menu order strange error
mrjasongorman replied to mrjasongorman's topic in General Support
Ok it seems to have nothing to do with MarkupSimpleNavigation, as i've looped through the array and it's still having the same sort problems Must be the sort=sort section in $pages->find() -
I'm just having some trouble with my main menu, it's started happening all of a sudden across a few of my processwire sites (completely separate). I'm using MarkupSimpleNavigation to generate the menu. But when i look at the menu the Home (id 1) goes into the second position in the menu rather than the first. But when i login and check again, it's back to normal. The tree structure obviously has Home as the root. <?php $topMenu = $pages->find('id=1|1018|1026|1019|1020|1021|1023, sort=sort'); ?> <?php $treeMenu = $modules->get('MarkupSimpleNavigation'); $currentRoot = $page->rootParent(); echo $treeMenu->render( array('max_levels'=>1, 'parent_class'=>'parent', 'current_class' => 'current'), null, $topMenu ); ?> This is the code i'm using to generate the menu. Any help on this would be great. Thanks
-
Breadcrumb foreach pagearray error
mrjasongorman replied to mrjasongorman's topic in General Support
Found the problem, there was some jQuery targeting the breadcrumb navigation removing nth child.- 4 replies
-
- breadcrumb
- foreach
-
(and 2 more)
Tagged with:
-
Breadcrumb foreach pagearray error
mrjasongorman replied to mrjasongorman's topic in General Support
Yeah it's strange everything appears to be correct until it actually goes through the foreach loop, then it misses out a page. Hierarchy and everything is correct and when looking at the page array object it's showing the correct number and order of pages.- 4 replies
-
- breadcrumb
- foreach
-
(and 2 more)
Tagged with:
-
I want to create a basic breadcrumb menu on my site and i'm using this code <?php $parents = $page->parents(); ?> <?php foreach( $parents as $item): ?> <span><a href='<?php echo $item->url; ?>'><?php echo $item->title; ?></a></span> <?php endforeach; ?> <span><?php echo $page->title; ?></span> When i print_r $page->parents() it has the correct count and urls. But when i go to foreach it misses out a step. for example if i was on the curriculum page it should say: home > about us > curriculum but it just echo's out: home > curriculum Am i doing the foreach wrong? i followed the example code Ryan posted for making a breadcrumb menu.
- 4 replies
-
- breadcrumb
- foreach
-
(and 2 more)
Tagged with:
-
Had the same problem, i increased the PHP memory in php.ini to 256MB. This works but it does take a good 5 seconds or so for large images to crunch down to the specified max image width (in my case 1000px). The files i'm uploading are between 5 - 10MB.
-
Using PDO/PostgreSQL instead of PDO/MySQL
mrjasongorman replied to Pierre-Luc's topic in General Support
MariaDB works fine with Processwire, we're using MariaDB where i work as our productions database for a few websites running on Processwire. PostgreSQL does sound interesting though. Is it possible to use a 3rd party ORM to hook into different databases? -
IIS 8.5 Processwire not displaying errors
mrjasongorman replied to mrjasongorman's topic in General Support
lol just realised i did a Git pull to the windows box, but forgot i had included the wire directory in the .gitignore file. #amateurhour -
I have IIS 8.5 running PHP 5.6 and i can't get Processwire to work. Normal PHP executes, but when i go to processwire it's just a blank page, even trying to display PHP errors just returns a blank page. my web.config is as follows (which worked on a previous windows processwire setup) <?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <rewrite> <rules> <rule name="CLEAN URLS" stopProcessing="true"> <match url="^(.*)$" ignoreCase="false" /> <conditions logicalGrouping="MatchAll"> <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" /> <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" /> </conditions> <action type="Rewrite" url="index.php?it={R:1}" appendQueryString="true" /> </rule> </rules> </rewrite> </system.webServer> </configuration> Can anyone with IIS and windows server knowledge help out?