We all know about Firebug, probably the best developer add-on out there, and how awesome it is and how many times it helped us debug some nasty Javascript code, mess around with CSS and HTML on-the-fly, to track the time load of every external page element our app loads… It’s so cool that it even has it’s own add-ons! (FirePHP, YSlow and FireCookie). Really, it helps our developer lives to suck a bit less.

Note: the following text is not about bashing other developers and their works, but to highlight the importance of proper input filtering. I myself have failed on this, several times.

Let’s go back to the part where we mess with the HTML by the means of this, may I say, application. You can add, hide, remove HTML elements, add, alter, remove, attributes from HTML elements… Adding, hiding, deleting - boring; altering - fun! I have this urge to try to break every form on every website I find. Not to do any harm, just to take a look how my fellow developer did his job and if I see anything that’s not right, I try to contact him to fix that, cause, y’know, I’m a nice person… Anyhow, I recently found some sites where all the textfields and textareas were filtered properly and no harm could be done - all my “hack” attempts were caught by their application. Nice. Oh, look, a select box! Right-click, inspect element, value=”xyz”, change that to value=”abc”, submit the form… and poof! A sexy SQL error. All that with the help of our li’l friend, Firebug. The elements where the user is required to provide some information “by hand” were processed correctly, but the select box was not.

OK, let’s take this one step further. On a site where the user can register an account and afterwards can edit his or hers profile. I register, go to the user panel, the usual stuff - change email, password, location, DoB (Date of Birth)… A quick inspection of the source - a hidden field “id” with a number in it. Hmm… Quickly, I register another account, note the “id” on that second account, go back to the first account, change the “id” of the first account to the “id” of the second account, change the DoB (just to see any actual information changing), click submit… “Your profile has been updated successfully.” Mine? Not really, the DoB is like it was in the first place… Go to the second account… Oh boy. I successfully changed the DoB of the second account, with my first account. Now, I haven’t seen their source code, but I can imagine what was going on. Something like this:

$id = (int)$_POST['id'];
$dob = $_POST['dob'];

$sql = "UPDATE users SET dob = '" . $dob . "' WHERE id = " . $id;

On the positive side, when I entered letters in that hidden field, I was told by the app that I haven’t filled all the fields correctly, which means they filtered even the hidden field, but skipped to check if that “id” is actually me.

OK, I know, the title is “Bad Firebug!” and the problems are actually about filtering user input, but I needed a catchy title to have your attention on Twitter :P

Even tho a field seems “unchangeable”, with a help of an awesome little app, it becomes changeable. And dangerous.

Filter input, escape output :)

P.S.: On the image above you can see my profile on a bulletin board, where I changed my year of birth from 1986 to 986 with Firebug. The years are in a select box; the lowest value is 1910. You can see my actual profile here.

Moblin got me curios and I wanted to test it out:

Moblin is an open source project focused on building a Linux-based platform optimized for the next generation of mobile devices including Netbooks, Mobile Internet Devices, and In-vehicle infotainment systems.

Cause I don’t own (yet!) a netbook, I installed it under VirtualBox (VB from now on). The image is 666 MB big and it comes not in an .iso, but in a .img format. But, VB, a really awesome software, had no troubles booting from it. As with the majority of Linux distros nowadays, Moblin image is also a Live CD, which means you can run it, without installing it.

The preinstall process is made up from 6-7 steps: choosing the language, the keyboard layout, the timezone and, of course, the partitioning. Basically, it’s just another boring “Next-Next” process. The installation itself took around 6 minutes to finish. When it’s done, it asks for a username and a password.

The first boot went pretty quickly, considering that booting under VB takes longer than booting under regular installations. The thing about VB is that it needs, the so called “Guest Additions” installed on the guest machine, so that the guest machine can be used normally. In this case, I failed to install it: Moblin comes with one version of the Linux kernel and the additions are for another version of the kernel. This prevented me in my quest to test Moblin fully. Anyway, I’ve managed to take a few screenshots of it, all are uploaded to my Picasa profile.

There was one thing that was strange. It has a “Status panel”, from which you can update your profiles on social networks. A really useful stuff. I just opened it up and updated my Twitter profile. Almost. I wasn’t logged in to Twitter from it and Moblin didn’t say a word about it. It just happily said that my status is updated. Once I found the “Web services” panel I logged in and this time I was really updating my Twitter stream.

I really was hoping to test it normally and write a detailed review of it, but this guest additions thingy thought otherwise. Moblin is a great distro, even in this beta stage I believe it’s useful. What do you think? Did you test it already, saw it in action?

One thing’s for sure: when I’ll get myself a netbook, it’ll run on Moblin.

Cheers!

P.S.: Check out the Moblin intro, too!

Wordpress is one of the best blogging platforms out there — if not the best. It’s very powerful, can be easily extended and modified. It’s documentation is very well written and, so far, had answer to all of my crazy questions :)

You know what’s the best part of Wordpress? With some knowledge of PHP and MySql, you can turn it into much more than just a blogging platform. After doing some HTML to WP work for Roger, I thought of one way how could Wordpress be transformed into a CMS. Note the “one way”. This is not the only way for doing this, and, most likely, not the best way.

I didn’t look much, but I think that there are some nice plugins out there that can do this. But, where’s the fun in the download, upload, activate process? Nowhere!

I will show you how to change your Wordpress into a CMS and it really doesn’t take much coding to achieve this! The example presented here is simple and will have a static page for it’s home page, another static page for the “Portfolio” page and the blog. The home and portfolio page will have some of own content and both will include some content from other static pages. You all most likely know the blog part ;)

Static pages

Things you should know: each static page has it’s title, it’s slug or name (the thing that shows up in your browsers address bar: http://example.com/portfolio/ - right there, the portfolio is the slug!), has the parent attribute and the template attribute. The parent attribute is used when it’s needed to make one page a child of another, i.e. to show Page2 as a subpage of Page1. The template attribute is used when we want to apply some different layout and styling to a static page. Read more about static pages and how to create your own page templates.

Continue reading this post…

I wrote a Python script for automating the steps required to setup a web project environment on my local dev machine that runs on Ubuntu. Called it pywst: Python, Web, Svn, Trac. That’s the best I could do, sorry :P

The main steps for setting up a new project are:

• Create a virtual host
• Add it to /etc/hosts
• Enable the virtual host
• Import the new project to the SVN repository
• Checkout the project to /var/www
• Create a TRAC environment for the project
• Restart Apache

After these steps I have http://projectName.lh/ which points to /var/www/projectName/public/, SVN repo under http://localhost/repos/projectName/ and the TRAC environment under http://localhost/trac/projectName/.

As I have this ability to forget things, I always forget a step or 2 of this process. Thus, I wrote pywst (note, this is a txt file, to use it, save it to your HDD and rename it to pywst.py). It’s not the best and nicest Python script ever wrote, but gets the job done. All that is need to be done to setup a project with pywst is:

sudo ./pywst.py projectName

2 things are required: to run it with sudo powers and to provide a name for the project.

Future improvements

The first, and the most important is to finish the rollback() method. Now, it only exits pywst when an error occurs, but it should undo all the steps made prior to the error.

Second, to make it work on other distros, not only on Ubuntu. That would require for me getting those other distros, set them up, look where they store Apache and stuff, where’s the default document root, etc. Hmm… This will take a while :)

Third, support PHP frameworks - Zend Framework, CodeIgniter and CakePHP — ZF is a must :P Under support I mean to create the basic file structure for them automagically.

Cheers!

Today I was messing around with Trac, installing it and doing some basic configuration. While my dev machine gets updated, I want to share my process of installing Trac.

What is Trac?

As said on the Trac homepage:

Trac is an enhanced wiki and issue tracking system for software development projects.

It’s free, it’s open source, it comes under the BSD license and it’s really awesome. You can write a wiki with it, have a ticket system, connect it with SVN, so you can browse the sources from the browser and see all the commit messages, when was something changed, added… It can support one project, it can support multiple projects. It can be viewable/editable by anyone, or you can close it down for your little team…

Trac is big. It has lots of plug-ins, so you can extend and customize your Trac. I haven’t played with them yet, but as soon as I will, you’ll get notified ;)

It’s written in Python. It can run on it’s own server, or it can run under Apache (where there are also several options). It can use SQlite, PostrgeSQL or MySQL databases. Currently it can connect only to SVN.

I’ll show you how to setup a basic Trac 0.11-dot-something-dot-something. It will run under Apache with mod_wsgi, use a SQlite database, connect to the SVN repository and require user authentication.

Continue reading this post…