PHP (incl PhpMyAdmin)

Firefox 3 ignores cache control http headers - security risk for online apps!

Tim Huffam — Fri, 26 Sep 2008 03:17:40 GMT

If a user, using Firefox 3, signs out of a web site and does not close the browser, anyone else using that browser subsequently can view the content of pages loaded by the previous user (eg in an internet cafe, or any place where workstations are shared eg universities) - exposing private/confidential data.

This only affects HTTP post requests (not gets) and only Firefox version 3 - earlier versions (1.5, 2 etc), and IE, are not affected.

The main points are:

This is definately a bug: a violation of RFC 2616, section 14.9 that states "The Cache-Control general-header field is used to specify directives that MUST be obeyed by all caching mechanisms along the request/response chain".
Some companies who deem this a significant hole in their security have chosen to block requests from Firefox 3 (eg they deem it their responsibility to secure their customers private and confidential data to the best of their ability).
This bug has been registered with the Mozilla dev team, but currently (as of 26 Sept 2008) has a status of unconfirmed.

CSS Absolute positioning in Firefox and IE

Tim Huffam — Fri, 05 Sep 2008 21:57:24 GMT

A couple of notes regarding absolute positioning in FF and IE...

Specifying position values:

IE allows you to omit the unit of measurement for Left and Top. It assumes pixels eg:
obj.style.Left = 10;
However FF requires that you specify the unit of measurement eg:
obj.style.Left = "10px";

Using other elements parents to calculate your object's position:

The scenario might be you have a div that you want to position over or by another object - but that object has no position values. In this case I use parent object values.

Don't use the IE specific property parentElement (this is not supported in other browsers) eg:
obj.style.Left = otherObj.parentElement.offsetLeft + 10;
note in this example (that works in IE only) there is no unit of measurement.
Instead use the parentNode property (this works for both IE and FF) eg:
obj.style.left = (otherObj.parentNode.offsetLeft + 10) + "px";

HTH
Tim

Web development client side debugging - display area, javascript injection and accessing the dom at runtime

Tim Huffam — Thu, 10 Jul 2008 22:52:27 GMT

For those of you who don't have access to IE or FF dev toolbars - this is how we used to do client side runtime debugging...

Drop the following code into your web page (preferrably at the bottom):

This should be self explanatory - the html controls provide a place to enter and run javascript (eg to query the DOM at runtime) and somewhere to dump the data. And the javascript provides some helper functions - for dumping data and for querying all the properties of an object.

The following is a IE specific version of the for loop which may show a few other properties:
for(x in obj)
{
msg+=x + ": " + obj[x] + "\r\n";
}

HTH
Tim

Scuttle import bookmarks not working

Tim Huffam — Fri, 04 Jul 2008 00:14:34 GMT

With a clean install of Scuttle I found that both the import bookmarks pages (importNetscape.php and import.php) do not work - instead the both display the source of the PHP files.

This is caused by both files not having the correct php declaration at the beginning of the file eg -both of these files first line was:

<?

However they should have been:

<?php

So just simply update these files.

HTH
Tim

Scuttle throwing PHP errors: Passing locale category name as string is deprecated. and Invalid locale category name LC_MESSAGES, must be one of LC_ALL,...

Tim Huffam — Thu, 03 Jul 2008 20:15:41 GMT

I got the following error on a fresh install of Scuttle (0.7.2) on a newly created Windows Server 2003 with PHP (5.2.6), MySQL5.0.51b) and IIS 6:

Warning: setlocale() [function.setlocale]: Passing locale category name as string is deprecated. Use the LC_* -constants instead in C:\Inetpub\Scuttle\includes\php-gettext\gettext.inc on line 131

Warning: setlocale() [function.setlocale]: Invalid locale category name LC_MESSAGES, must be one of LC_ALL, LC_COLLATE, LC_CTYPE, LC_MONETARY, LC_NUMERIC, or LC_TIME in C:\Inetpub\Scuttle\includes\php-gettext\gettext.inc on line 131

After googling for a while I found this simple solution (here: http://www.hermann-uwe.de/blog/server-client-bookmarks-a-la-del-icio-us#comment-52097 posted by CharlesW):
Add the line: if (!defined('LC_MESSAGES')) define('LC_MESSAGES', 5);
to the top of functions.inc.php.

Thanks a million CharlesW!!!

Getting PHP 5.2.6 and MySQL (and PHPMyAdmin) working on IIS 6 Windows 2003 Server

Tim Huffam — Tue, 01 Jul 2008 21:18:13 GMT

It seems every time I try to install PHP and MySQL something doesn't work - usually there's either a file missing from the PHP distro or something in the install notes is missing or incorrect. This time it was both.

I first tried the PHP msi install - first mistake. As it does not include the MySQL extensions - neither does the 5.2.6 PECL zip file (I mistakenly thought this would include all the extensions). So if you've installed PHP using the MSI installer - uninstall it (via Control Panel - Add/Remove Programs). Also - you may need to manually remove any remants of this PHP installation manually - I had to manually delete the php directory.

Now with a clean slate do the following:

Download the PHP zip package from here.
Extract the zip - in my case into D:\php-5.2.6-Win32
Copy php.ini-recommended and rename it to php.ini (within this same dir).
Edit php.ini and make the following changes:
1. Set the extension dir eg:
  extension_dir = "D:\php-5.2.6-Win32\ext"
2. Uncomment the extension setting for mysql eg remove the ';' from the beginning of the line:
  extension=php_mysql.dll
Within IIS admin tool:
1. Within Application Configuration (within 'Home Directory' of a site) add the php extension - mapping 'php' to php5isapi.dll (eg D:\php-5.2.6-Win32\php5isapi.dll).
2. Within Web Service Extensions add one for php5isapi.dll (eg D:\php-5.2.6-Win32\php5isapi.dll) setting it to 'Allowed'.
Update the PATH environment variable to include the php dir eg D:\php-5.2.6-Win32.
Add a new environment variable called PHPRC and set to the php dir eg D:\php-5.2.6-Win32 (this part was missing from the install docs for IIS).
Restart iis (eg run iisreset from the command prompt).

Bingo - that's it. To test create a file called phpinfo.php (and place in the web root) with the following:
<?php
phpinfo();
?>

The critical part to check here is that the output of this phpinfo shows the 'Loaded Configuration File' is set to the php.ini file you created above. If PHP is configured correctly to use mysql it this (phpinfo output) will have a MySQL section - if this is missing - then something is wrong.

HTH
Tim

Centering div tags using CSS

Tim Huffam — Tue, 15 May 2007 05:11:00 GMT

As text-align doesn't work I use a simple work around:

.mydiv{
width: 100%;
left: 50%;
}

It's not perfect - but very simple and easy to understand - and you can modify it to suit.

Seems to work ok in IE 6 & FF 2.0.

Here's another method (http://www.andybudd.com/archives/2004/02/css_crib_sheet_3_centering_a_div/index.php) - but I found it not obvious/simple enough (expecially for others who may have to maintain the css down the track - KISS)

HTH
Tim

Printing nicely from the web: Printing web pages or alternate documents

Tim Huffam — Mon, 30 Oct 2006 23:30:00 GMT

Many web pages are not designed with any consideration for printing - this is one of those annoying things that one comes across more often than not.

Here are a couple of simple ways to make sure your pages are printed in a formatted way:

Use a specific print style sheet.

This is the most common approach used on the web. The idea being you create another stylesheet that is specifically for formatting your web page(s) for printer output.

There are many examples on the web of how to do CSS so I won't go into that. However what you may need to know, is how to specify an printer specific stylesheet within your page.

A normal stylesheet is added like this:
<link href="default.css" type="text/css" rel="stylesheet">

where as a print specific stylesheet is added like this:
<link href="print.css" type="text/css" rel="stylesheet" media="print">

By adding this to your web page, whenever the user click on the Print button the page will be formated using the print stylesheet.
Use an alternative document.

This is a less known method, which can be very effective. Basically it tells your browser to use an alternative document whenever the user clicks on Print. This alternative document can be any web resource eg another web page or something like a word document, spreadsheet or pdf document. What's good about this that things like word or pdf documents are very quick and easy to create and format - so you know what it's going to look like printed right away (I find it way easier to create and format a word doc than fiddling with stylesheets).

This is how to specify the alternate print document:

<link href="worddoc.doc" type="application/msword" rel="alternate" media="print">

Note that you should specify the correct content type.

HTH

Tim

DOM Inspector missing from Firefox 2.0

Tim Huffam — Tue, 24 Oct 2006 23:46:00 GMT

If you've just installed Firefox 2.0 and found that the DOM Inspector is missing, here's how to add it:

Run the Firefox 2.0 install again.
Choose to do a Custom install (not the default of Standard)
Make sure DOM Inspector is selected.
Complete the install.

I had previously posted a solution for missing DOM Inspector for Firefox 1.x here. However that solution does not work with Firefox 2.0.

HTH

Tim

Error using client certs: The page requires a valid client certificate (403.13). How to turn off CRL checks in IIS.

Tim Huffam — Sun, 11 Jun 2006 21:57:00 GMT

The following error may occur when trying to use a client cert for the first time (this error is from IIS 5):

The page requires a valid client certificate

The page you are trying to view requires the use of a valid client certificate. Your client certificate was revoked, or the revocation status could not be determined. The certificate is used for authenticating you as a valid user of the resource.

HTTP 403.13 - Forbidden: Client certificate revoked

The cause of this is usually "the revocation status could not be determined.". This is because CRL (certificate revocation list) checking has not been setup on the server.

The simple solution for this (for development), is to just disable CRL checking.

You can do this using an IIS metabase tool (eg IIS Metabase Explorer) or adsutil, or, if you dont have these tools installed, you can run some VBScript to disable it - and this is how:

Create a VBScript file with the following code:

Set oWeb = GetObject("IIS://localhost/W3SVC")
oWeb.CertCheckMode = 1
oWeb.SetInfo
Set oWeb = Nothing
Save it to a .vbs file eg c:\turnoffcrlcheck.vbs
Execute the script at the command prompt eg:

cscript.exe turnoffcrlcheck.vbs

And that's it. You should not need to restart IIS.

HTH

Tim