corePHP Blog

Control HTML without javascript

Rafael Corral — Wed, 01 Sep 2010 15:05:42 +0000

This is something I have known about for a long time. It is advanced and can mostly be used for Cross Site Request Forgeries (CSRF). Not that I condone these, but the best way to defend yourself against hackers is by knowing as much as they do.

In some cases users turn javascript off in their browsers (I do) for security reasons. HTML has just about no scripting capabilities if you discard the FOR attribute on the LABEL tag. It is possible to trick a user into submitting a form by them simply highlighting text on a page. The FOR attribute binds a label to another element, which is some sort of scripting, I guess.

Well, by simply wrapping the BODY of a page in a LABEL tag, which contains text and HTML, the LABEL and its contents become a button through binding of the FOR. This all happens behind the scenes. This means that whenever you select text or click on the body of the page, the binding becomes active, and it is possible to submit a form without any scripting at all!

Example:



Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor
incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud
exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.
Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore
eu fugiat nulla pariatur.

On my example I show a POC on how you could automatically log someone out of twitter by them simply clicking on a page. Twitter has fixed this CSRF by simply checking the referrer on the browser: If it doesn’t match twitter.com, it sends you to another logout page for you to confirm your action.

This is good knowledge. Use it to protect yourself and not to harm others.

I use a plugin for FireFox called NoScript. This plugin will block all scripts on a per-domain basis. If you trust the domain, then you can enable those scripts. This is extremely helpful because I visit many hacked packages on a weekly basis and I do not want my computer to get a virus. This plugin will protect you from at least 70% of web attacks. I highly encourage you to use it.

Controlling Joomla! templates depending on menu you use

Jonathan Shroyer — Thu, 26 Aug 2010 20:42:26 +0000

We have been working on building a multi-school Joomla! website and there have been many hurdles to overcome since Joomla! isn’t a multi-site CMS. After searching for anything that’s common across each school, I realized the menu for each school could be used as a common denominator. If I could set a variable depending on which menu is loaded on the page then I can do just about anything I want, such as change the logo, set a unique CSS class, etc. After meeting with our developers we figured out how to do this and I’ll share it with all of you in case you ever need to do the same.

To start we need to pull in the information of which menus are being used on the page. Place this code in the head of your template:

jimport('joomla.application.menu');
$menus = JSite::getMenu();
$m = $menus->getActive();

This checks for the active menus on the page and sets it into the variable $m so we can manipulate it. Next, you need to look at the menutype in the administrator Menu Manager (under Type). This is what we will use to determine which school is being viewed. I want to take this information and set a new variable named $school:

if($m->menutype == 'district-information') { $school = 'district-info'; }
if($m->menutype == 'cityname-elementary-school') { $school = 'cityname-elementary'; }
if($m->menutype == 'cityname-middle-school') { $school = 'cityname-middle'; }
if($m->menutype == 'cityname-high-school') { $school = 'cityname-high'; }

The first thing I did was echo the variable $school into an ID on the body tag.

body id="< ?php echo $school; ?>"

This allows me to style the CSS uniquely according to the school being viewed which gives you a lot of style control. To change the logo I can just call it by the school.

#cityname-high .logo {background: url(../images/logo-highschool.jpg);}

Another thing I did was load a unique module position according to the school so I could publish modules in all pages the menu shows up on. I did this by doing the following:

if($school == 'district-info') {
    echo '';
};
if($school == 'cityname-elementary') {
    echo '';
};
if($school == 'cityname-middle') {
    echo '';
};
if($school == 'cityname-high') {
    echo '';
};

As you can see this can give you the ability to do things you may not have been able to do before in Joomla!. I know it saved me from a major headache!

Wordpress for Joomla! Training now available in Joomlashack University

Michael Pignataro — Tue, 24 Aug 2010 22:24:09 +0000

JoomlaShack recently released a very informative, in-depth training lesson in their Joomlashack University on how to set up and use the Wordpress for Joomla! extension by corePHP. Wordpress for Joomla! is a powerful new Joomla extension that allows you to use Wordpress blogging software inside your Joomla website. With Wordpress for Joomla, you can enjoy the best blogging platform integrated with the best content management system available. You can even use Wordpress plugins and Joomla modules all at the same time, on the same blog. It’s amazing!

In this new Quickshot preview of Wordpress for Joomla, JSU instructor Forest Linden gives you a very brief overview of just a few of the many cool features that Wordpress for Joomla! has to offer.

If you liked this Quickshot preview and want to know more about Wordpress for Joomla!, please visit the official Wordpress for Joomla product page. If you decide to purchase it and want to know all the cool shortcuts, secret tips & tricks we found, please consider joining our Joomlashack University to get access to the complete 35 minute Wordpress for Joomla! training video AND dozens more Joomla training tutorials & videos.

Want to learn more about how to build professional websites with Joomla? Then check out Joomlashack University, the #1 Joomla online training program in the world.

The if() Control Structure

Bernard Robbins — Fri, 20 Aug 2010 20:38:26 +0000

if() gives you a choice between outcomes you choose yourself. This gives you the most flexibility out of your projects.

Out of all the control structures, if() is probably one of the most used and has the most flexible ways of being written. Readability should be taken into account when you decide which way to write it. Using braces is the wisest since it doesn’t leave any room for error in what the author meant to include in the statement. if() statements may be written inside functions / methods, inside and outside most other control structures, procedural PHP, and HTML files.

if ( expr )
    statement

-or-

if ( expr ) {
    statement;
} elseif ( expr ) {
    statement;
} else {
    statement;
}

The brace-less semicolon way is best for intermingling PHP with HTML. (i.e. view scripts from your MVC layout.) This way you can naturally write your HTML in your statements without having to use any quotes.


    HTML Code 1

    HTML Code 2

The Ternary (ter•na•ry) Operator is a special if() statement for small expressions. You can nest the ternary as many times as you would like, but more than once is usually frowned upon since your intentions will be unclear for other developers.

(expr1) ? (expr2) : (expr3);
(test for true) ? (do this if true) : (do this if false);
echo TRUE ? 'Yes, I am true' : 'I am not true';

prints: Yes, I am true

$value = FALSE ? 'Yes, I am true' : 'I am not true';
echo $value;

prints: I am not true

Setting up a Joomla! Development Environment

Dustin Clute — Wed, 18 Aug 2010 16:14:12 +0000

If you are new to web development and are interested in using Joomla!, you may have used Google to try and find info to help you out. You may have done a search for “joomla development” or “joomla development tools” and got Setting up your workstation for Joomla! development as one of the results. This explains how to set up XAMPP and Eclipse on Windows, Linux and OS X. Now this document has some extremely useful information for people looking to get started. They even state that there are many possible configurations of environments for developing for Joomla!. I’m going to talk about how I have my environment setup for web development.

My workstation is setup with Ubuntu 10.04 running lighttpd/PHP 5.3/MySQL 5.1. I’m not going to go into details on how to install Ubuntu because there are already a few articles and blog posts out there explaining how to do this. Lighttpd is a web server like apache which aims to be fast and efficient with your system resources. You can use Apache if you like but I’m going to go over how I have lighttpd/PHP/MySQL set up.

Since I am using Ubuntu, I can just install everything needed from the Ubuntu repositories. All the commands below require you to open up a terminal and type in the command or copy & paste for them to run.

The following command will install lighttpd, PHP 5 with some extra packages, and MySQL.

$ sudo apt-get install lighttpd php5 php-pear php5-cgi php5-xdebug php5-curl \
php5-gd php5-mcrypt mysql-client mysql-server

During the install you will be prompted to insert a MySQL root password. This password is not the root password to your computer.

Note that you can see what other extra PHP packages are available by doing the following command in a terminal window :

$ sudo apt-cache search php5

Now that everything is installed, let’s begin setting it up.

By default, lighttpd runs under its own user and serves documents out of /var/www. While I’m working I don’t really like to leave my home directory. I also don’t want to deal with a problem because of permissions. So I prefer to have the web server running as my user and the web root sitting in my home directory. Now we will go over how to accomplish this.

You can name any of the directories below the way you want and organize them how you want. You just need to make sure you put the correct paths for the directories you create in the configuration file.

On my system, I put everything under ~/work (the “~” is a shortcut to the full path of your home directory). First, we are going to create the web root directory where all the code will reside.

$ mkdir -p ~/work/webhome

The -p flag of mkdir makes sure all parent directories are created. If none of the directories are there, it will first create the work directory, then the webhome directory.

We need to create the log directory, upload directory, and compress directory (if you enable mod_compress) into the home directory. I do this so I don’t have to mess around with changing a bunch of permissions.

$ mkdir -p ~/work/lighttpd/upload
$ mkdir -p ~/work/lighttpd/log
$ mkdir -p ~/work/lighttpd/compress

Now it’s time to change the paths and setup lighttpd. You can use whatever editor you like - just replace vim below with the name of the editor you want to use.

$ sudo vim /etc/lighttpd/lighttpd.conf

We need to first make sure some modules are enabled for lighttpd to work. By default everything we need is there but mod_fastcgi, which will allow lighttpd to parse PHP files. Below is the server.modules section of my lighttpd.conf file.

server.modules              = (
            "mod_access",
            "mod_alias",
            "mod_accesslog",
            "mod_compress",
            "mod_fastcgi",  # this needs to be added as it is not there by default
#           "mod_rewrite",
#           "mod_redirect",
#           "mod_evhost",
#           "mod_usertrack",
#           "mod_rrdtool",
#           "mod_webdav",
#           "mod_expire",
#           "mod_flv_streaming",
#           "mod_evasive"
)

Now we change the following options in the lighttpd.conf file. Make sure you use the full path of the folders you created above along with the user:group you want the server to run as. Below are the options that are changed in my lighttpd.conf file.

server.document-root = "/home/dustin/work/webhome"

server.upload-dirs = ( "/home/dustin/work/lighttpd/upload" )

server.errorlog = "/home/dustin/work/lighttpd/log/error.log"

accesslog.filename = "/home/dustin/work/lighttpd/log/access.log"

# size in kbytes - this is optional if you want to be able to upload big files
server.max-request-size = 20000

server.username = "dustin"

server.groupname = "dustin"

# if you have mod_compress enabled
compress.cache-dir = "/home/dustin/work/lighttpd/compress/"

Once done, save and close the file.

We enabled the module for fastcgi in the lighttpd configuration file. We need to enable the configuration for fastcgi. The following command accomplishes that.

$ sudo lighty-enable-mod fastcgi

Now we need to change the /etc/init.d/lighttpd file which controls starting/stopping/restarting of lighttpd. Since we changed the user:group that lighttpd runs as, and its init script makes sure that the directory /var/run/lighttpd is there with the correct user:group, we need to change the user and group.

Open /etc/init.d/lighttpd with your editor from the command line.

$ sudo vim /etc/init.d/lighttpd

We need to change the following line. Make sure you change www-data:www-data to the user:group you set in the /etc/lighttpd/lighttpd.conf file. Below is the original line and how I changed it:

chown www-data:www-data /var/run/lighttpd

changed to:

chown dustin:dustin /var/run/lighttpd

Once done, save and close the file.

There is one more change we need to make so paths work correctly in PHP. We need to open /etc/php5/cgi/php.ini and make sure cgi.fix_pathinfo=1 is uncommented. So open /etc/php/cgi/php.ini in your favorite editor.

$ sudo vim /etc/php5/cgi/php.ini

Search for cgi.fix_pathinfo=1 which is on line 842 on my machine and uncomment it by removing the ; at the beginning of the line.

Now lets restart lighttpd for all the changes to take affect.

$ sudo /etc/init.d/lighttpd restart

You should now be able to browse to http://localhost/ and see an empty directory listing. Now you can create different directories with installs of Joomla! or whatever you please and access them via http://localhost/directory_name or http://localhost/file_name.php.

One last thing we need to do is create a MySQL user to use. Now since this is more than likely your development machine using, the MySQL root user isn’t a huge problem. Just don’t ever use the MySQL root user for your scripts on a production server. This can lead to a lot of problems.

To create a new user:

$ mysql -u root -p
# you will be prompted for the password you entered during install
mysql> CREATE USER 'USER_NAME_YOU_WANT'@'localhost' identified by 'SOME_PASS_YOU_WANT';
mysql> GRANT ALL PRIVILEGES ON *.* TO 'USER_NAME_YOU_WANT'@'localhost' WITH GRANT OPTION;
mysql> FLUSH PRIVILEGES;

Reference: MySQL Adding Users

At the very least, I hope this post gave you some ideas for playing around and setting up a development environment that is comfortable for you.

Lifestream for Joomla! from JoomlaShack

Michael Pignataro — Tue, 17 Aug 2010 20:09:14 +0000

Need an easy way to keep your friends, family and business associates updated on all your activities; across multiple social networks; at any time of the day and in one convenient place?

Sound impossible? Well, now you can!

Introducing Lifestream for Joomla, an exciting new social media extension from our friends at Joomlashack!

Lifestream for Joomla lets you present the social media feeds of your choice to your audience in a highly-configurable and easy-to-set up Joomla 1.5x component & module. It dynamically updates your website with your favorite social network feeds 24/7.

Lifestream for Joomla lets you…

display multiple social network feeds separately or together as an integrated stream
display in 3 different views: tab, grid (side-by-side) or integrated
set up your streams as a component (front page, for example) or a module (throughout your site, etc)
add multiple accounts/users for each social network feed to create even more interesting streams
choose between the included Light/Silver or Charcoal/Grey themes..or create your own themes!
add custom formatting to each of your streams for infinite style possibilities
download updates/fixes and new social network integration plugins for FREE during your 6-month access period
get 6 months of FREE access to Joomlashack’s amazing customer support team should you need any help
and so much more!

We LOVE this extension. It’s a great extension at an even better price!

$24 instant download

How to use countModules in any Joomla! file

Jonathan Shroyer — Fri, 06 Aug 2010 19:00:33 +0000

One of the core parts of creating Joomla! templates is using $this->countModules to show or hide code depending on if a module is in a particular position on the page. It is very powerful and it makes your templates very dynamic according to what is happening on the page. So what happens if you need to do this outside of the template index.php file? Save yourself a huge headache and use the following code in any file to check for a module position:

jimport( 'joomla.application.module.helper' );
if(count(JModuleHelper::getModules('left'))) {
	put your code here
}

A very powerful addition to you Joomla! PHP library!

A sneak peek of MailChimp intergration for Joomla!

Michael Pignataro — Fri, 06 Aug 2010 15:34:07 +0000

Joomla’s popularity as one of the world’s foremost open-source content management systems is undeniable. And just got better with a complete integration of MailChimp.

MailChimp Integration into Joomla!

But until Joomailer was released last year, the options for managing email marketing via Joomla were extremely limited. The best solutions for integrated management had nowhere near the power of hosted solutions. Hosted solutions lacked integration – signing up for membership did not necessarily integrate with mailing lists and vice versa.

Let’s face it – if you’re going to run a member-driven site, these things should be seamless.

When Joomailer was released last year, it brought the power of one of the world’s leading newsletter management apps, Campaign Monitor and merged it with Joomla. In a stroke, it was now possible to manage your site and your email marketing from one admin control panel. Brilliant!

More importantly for web developers, it allowed us to provide a complete solution for our clients – no more multiple logins.

Now Joomailer just got a whole lot better.

Working together with MailChimp, FreakedOut has created a new version of Joomailer which integrates with the popular, simian-styled marketing manager.

Best of all, the component is 100% free!

The advantages of MailChimp are undeniable:

A ‘Free for life’ plan, including up to 500 subscribers and 3000 emails per month
List segmentation – target members based on known preferences to increase conversions
A vast array of import options
Powerful anti-spam features with whitelisting on many mail providers
Email tracking and analytics
Social media integration – use and track Facebook ‘Likes’ directly in your mailouts!

Back-end Interface for MailChimp for Joomla

To be released shortly, the new MailChimp version of Joomailer will allow site owners to manage almost every aspect of their campaigns from their Joomla backend.

Existing site members can be synced with the MailChimp member database and with FreakedOut’s registration injection script, new site members will be able to subscribe directly via the standard Joomla registration form, Jomsocial or Community Builder.

Sending out a newsletter with Joomailer is simple: just choose your template, choose your subscriber list and select which articles you’d like to include. That’s it – you’re ready to send!

You can even choose to send just the article intro-text and automatically include a read-more link back to the article on the site.

It takes enough time to generate quality content as it is – why waste more having to re-write for different media? Joomailer makes it simple to re-purpose your site’s content and use it as a powerful ongoing engagement tactic to provide continued value to your subscribers.

What’s stopping you? Get started with a free MailChimp account, download the free Joomailer component and start marketing today!

For More information - http://www.freakedout.de/blog/77-mailchimp-meets-joomla.html

WordPress for Joomla! 3.0 Sneak Peak!

Rafael Corral — Mon, 02 Aug 2010 13:30:27 +0000

It gives us great pleasure to present one of the largest updates we have ever created for one of our products. Now presenting…Wordpress for Joomla! 3.0! (sparkle sparkle)

Wordpress for Joomla! 2.x combined the best blogging platform with the best open-source content management system available. Since its release, we’ve become aware of a few problems dealing with plugins and occasional Wordpress templates. So we tucked ourselves away for the past month and half in a dark room and alternately drank great deal of energy drinks and coffee and set out to make Wordpress for Joomla! perfect. I think we have succeeded! Read on for some of the major enhancements in “Wordpress for Joomla! 3.0″…soon to be released!

Rewritten from the ground up. We have spent a great deal of time re-tailoring our integration. Wordpress for Joomla! 3.0 is more stable, easier to use, and, of course, still just as seamless as Wordpress 2.x to the end user.
90% of plugins for WordPress will work. This ability has been heavily requested by our users and it is now available.
Native WordPress Theme support. WordPress for Joomla! 3.0 allows you to utilize 3rd party themes for WordPress inside of Joomla!
Reduced pricing. Here at ‘corePHP’ we feel it is important for everyone to have the ability to utilize our product. The new WordPress 3.0 will be available at a special pricing point of $69.99/year subscription.
Pre-order now. We are only a few weeks away from releasing WordPress for Joomla! 3.0 and we want you all to be the first to get your hands on the product. So we are allowing pre-orders with an early bird special of $49.99 for the first year and $69.99 each year afterward. Pre-Order now!

So without any further delay here is a sneak preview of what has been happening behind closed doors:

If you would like to give this version a test drive once we are ready for beta, sign up here.

Pixel Perfect Web Design

John Furrow — Fri, 30 Jul 2010 04:34:11 +0000

Have you ever noticed that Photoshop will anti-alias the edge of a rectangle? This is because the edge of the rectangle happens to fall in the middle of a pixel. If you follow these few simple rules when designing websites in Photoshop, you can ensure that the edges of your rectangles will fall exactly on the edge of a pixel, making the shape super crisp and sharp.

The first thing you want to do is make sure that you enable the option to snap rectangles to whole pixels. You can set it through a check-box in the toolbar when you have the rectangle tool selected (shortcut: U). Click the drop-down button next to the “Custom Shape” button in the shape toolbar. Then check “Snap to Pixels.” See the following screen shot:

Now, whenever you draw a shape, you can be confident that you will only fill whole pixels. However, there will still be issues when you try to re-size the shape in the future. If you try to use the transform tool, all bets are off: The edges of your shapes will fall in the middle of pixels. Photoshop will try to make up for it by anti-aliasing, but we want a sharp, crisp edge. See the following screen shot:

Solution: Instead of using the transform tool to re-size your shapes, use the “Direct Selection Tool” (keyboard shortcut A).

With this tool, you can select individual points in your shapes and move them accordingly. Hold shift while clicking on points to select more than one at a time.

When you click and drag your selected points, the line will snap to the edge of pixels. See the following screen shot:

You can also use the arrow keys to move the points around. However, you must make sure you’re not “zoomed-in” or “zoomed-out” at all. You MUST view the document at 100% to make sure the points snap to whole pixels. The only exception to this rule is when you hold the shift key while pressing the arrow keys. This will move your points in 10 pixel increments exactly, regardless of how far zoomed-in or zoomed-out you are. So if your points were already on the edge of a pixel, they will remain on the edge of a pixel when you move it by 10 pixels.

With these simple steps, you can be confident that your shapes are as crisp and clear as possible!