Tag Archives: PHP

Zend_Http_Client and Case Sensitivity

micro tutorial, PHP, zend framework, , , , , , ,

Recently I posted about Zend_Http_Client and the ability to check a request HEAD or GET. It is, as everything in Zend Framework, extremely easy to adopt and use, but today I experienced some “strnage” problems!

As I wrote some lines of code,

<?php
....
$client = new Zend_Http_Client('uri_path');
$request = $client->request('head');
...
?>

so far so good, everything worked just perfect until I deployed the “working” code on the production server. Than odd enough some requests just crashed. Not all – just some of them.

Another strange thing was that no exception was thrown.

Maybe using more my intuition instead of my brain I just tried to request the head using capital letter – HEAD. And as everything was strange enough, yet again this solution happened to be working! That solved my problem.

<?php
....
$client = new Zend_Http_Client('uri_path');
$request = $client->request('HEAD');
...
?>

Custom Filters in Zend Framework

micro tutorial, zend framework, , , , , ,

Although there might be tons of articles about this theme I’m going to describe it in breve. What I was supposed to do is to filter a string, which is supposed to be a date, but if only the year or year/month pair were present I should filter them correctly.

So the first thing I tried to achieve is to write a custom Zend Filter. It seem to me a simple task and it is.

The only thing you should do is to define a class in Zend/Filter/ folder with the name of the filter of course. In my case this was Zend_Filter_Mydate, which really sounds very strange, but you can name it after whatever you want.

The only thing you need in that class is a public function filter by giving it one parameter, in most cases, and returning the filtered value.

Here’s a snippet:

<?php
 
require_once 'Zend_Filter_Interface.php'
 
class Zend_Filter_Mydate extends Zend_Filter_Interface
{
 
    public function filter($value)
    {
        // do something with the source and return the filtered value
    }
 
}

Secure Forms with Zend Framework

micro tutorial, PHP, zend framework, , , , , , , , , , ,

Maybe the correct title is not “with Zend Framework”, but “with PHP”, because the general approach I used is purely PHP and no Zend Framework dependency is used. However let me mention that ZF allows you to build forms with Zend_Form, which gives you an abstraction over the HTML forms with many goodies like validation, filtering and protection.

Zend_Form and Zend_Form_Element_Hash

Although the technique I’m using is doing the same thing, note that in ZF there’s a Zend_Form_Element_Hash which generates and validates the form, thus protecting you from CSRF attacks. The thing is that I didn’t use it because the form I’m protecting is not generated with Zend_Form, and I cannot benefit from everything ZF is giving to me. However you can easily reproduce the basic strategy with every form and every framework till it’s written in PHP.

What’s the solution?

It’s pretty simple and it’s described many many times around the web, simply generate a random hash, a possible solution is to use uniqid in combination with mt_rand and md5, thus you’d get quite strong hash.

Step two is to pass this generated hash, also stored in the session in a hidden value of the form. Of course now the most asked question is: but that’s visible to the source and thus everybody will have a valid hash.

There’s the trick. OK everybody will have a valid hash, but on submit the hash is validated against the SESSION variable, and as you know the session is specified between the browser (client) and the web server. Although the attacker may have a valid hash he must execute the attacking script from the same domain, possibly with the same browser, which makes the task rather difficult.

An Example

Let me show a breve example, it may help make things clearer.

1. First step – start the session

<?php
session_start();
?>

2. Second step – validate the form against the $_SESSION and generate a valid token

<?php
if (isset($_POST['name']) && $_POST['token'] == $_SESSION['token'])
    echo $_POST['name'];
else
    echo 'dont hack';
 
$_SESSION['token'] = md5(uniqid('test', true));
?>

3. Third step – make a form

<form method="POST" action="">
<input type="hidden" value="<?php echo $_SESSION['token'] ?>" name="token" />
<input type="text" name="name" value="stoimen" />
<input type="submit" name="submit" />
</form>

Demo here.

For more to test this you may try to make the same form somewhere else on the web and to point the action to http://www.stoimen.com/projects/php.secure.forms/! Without the session validation it’s absolutely sure you can post on the attacked server.

P.S. Now I’ve to admit that this have nothing to do with Zend Framework, however it’s good practice and thus may be used with every framework.

Modyfing Response Headers with Zend Framework

web development, , , , , , , , , , , ,

Response Headers

You’ve probably seen that you can track the server response headers with Firebug – a wonderful extension to Firefox.

But have you ever asked yourself how to change a response header with Zend Framework.

header()

Typically this is done with the built in PHP function header, where you can setup the header the page must return, but how to make it with Zend Framework?

It’s pretty simple of course, it’s Zend Framework in fact. To be more precise I’ll post a snippet:

$response = $this->getResponse();
$response->setHeader('content-type', 'application/x-javascript; charset=utf-8');
$response->sendResponse();