deansatch

It’s quite hard to explain what I mean without an example but imagine these scenarios:

1. Without csrf protection I get an email asking me to login and update something. I click the link, see the familiar login page and login. It logs me in and I update stuff and log out then go about my day.

2. With csrf protection I get the email, click link, login but it fails and shows me the real login page. I go back check the email and spot the dodgy url. I quickly change my password and delete the email

In scenario 1 the hacker can create a page to spoof the login, post to a script which stores the post data, then uses curl to post it directly to the real login post endpoint and the lack of csrf protection allows it

Maybe not a huge deal but still something to think about

What I mean is, if the copycat page is a spoofed login page, it will fail csrf verification on your site (if it exists) when the user enters their details, basically alerting and getting their attention so they will spot the problem and change their login details.

If you don't have csrf on, the copycat page could harvest the login details then log them in seamlessly. So they might not know they've given away their credentials for a while longer...long enough for them to be exploited

@snapey if there is no csrf on a login form does that not allow a much more convincing phish? e.g. send an email with a copy of login page on a different domain, user falls for that, fills it in, login details are captured then forwarded/reposted to the real login form and the user is logged in smoothly without any knowledge that something went wrong? As opposed to logging in and it failing first time making the user go back and question what they just did

It’s public facing data and stats are made up from both visitor contributions and user activity. Doesn’t need to be updated more than once a day but it would be a bonus if it could be updated more often though. No login required

How would something like that be set up? I suppose it has to run for each user. Some sort of queue??

I can’t set a flag because the figures are calculated from a combination of thousands of rows across 8 tables and some queries are built based on the results of the previous so basically have to run the whole thing to just to see if anything is different. I was thinking of just using eloquent update() as I’m pretty sure that will insert a record if it is a new user or update if it is existing and has changed

Problem is there are a lot of pages and that will continue to grow. So using the remember() helper works but one page for example will take 10 seconds to load first time until cached. After that it is fine. But in 24 hours time if nobody has visited that page again google could be the next one to visit and then it will lose its position in Google’s index. Even if a human visits it first time it isn’t good that it loads so slow for one person every day.

A cron has to be the way forward it is just which method is the best? I could run a foreach loop to update the stats as flat figures in a dB table but is that really the best way? And would the cron be subjected to the Php execution timeout?

I have posts with authors. Authors could be admin, editor, customer etc... I want to count posts by each type and find who which type posted the most and which one the least.

e.g. output I want is:

admin (43 posts)
customer (21 posts) //I don't actually need this one
subscriber (3 posts)

So I can end up with variables like

$mostPosts; // should be equal to 'admin' 
$leastPosts; // should be equal to 'subscriber'


//ideally I would have something like:

$array = [
    'mostPosts': {
        'type': 'admin',
        'count': 43
    },
    'leastPosts': {
        'type': 'subscriber',
        'count': 3
}
    ];


//starting from...

$posts->with('author')->....

With this, speed of execution is most important

I’m leaning more towards the cron method tbh. It just seems like someone is going to suffer a slow load every day otherwise.

Any other ideas?

The reason the query is slow is because it needs to make 4 queries on massive amounts of data then make calculations based on the results of each so it will take longer as the site grows

I was thinking about this but does that not mean someone would have to visit every single page 1st for the cache to happen? i.e. the first visitor to each page would get the slow page load.

Then if I am pushing site updates every couple of days would each envoyer deployment not wipe that cache again?

Just thinking it isn't much good caching queries if google might be the first visitor to all the pages resulting in a big drop in page ranking

I have a section on a site that shows a calculated stat on each post/page. The queries that run to generate the number slow the page load down by about 1 second. What is the best way to serve this to users as a daily cache instead of running the query on every page load? It won't change massively over the course of 24 hours so a daily refresh would be fine.

This is a different figure on each page and there could be 10s of 1000s of pages

Are there any symbols in your password? If so wrap it in "password". Also check to see if outlook has 2 factor auth which may need to whitelist your app ip

I think your best bet would be to do a single query for the last 18 months then format the collection afterwards

Also, why would last 9 months be 40 records and not 150? Would it not at least include the las 3 and 6 months within? If not it sounds more like you are wanting to paginate a query by date

@GOUSEFEROZ - If you change your worker conf file you will have to reread, update and start supervisor again

Also, is the path to artisan correct for your server?

@GOUSEFEROZ - Did you start supervisor? I see you have “sqs”. Remove that if you aren’t actually using it

@GOUSEFEROZ - You need to run it as a background process otherwise it will be killed when you exit terminal. Look at the supervisor link - it will take care of that and ensure it restarts if anything goes wrong

@AURAWINDSURFING - Hopefully in 10 years time the timestamp column type will have been “upgraded”

@AURAWINDSURFING - It would seem that way yes. If you can insert a 2045 date in a timestamp column I’d like to know how you did it. I think there is an assumption that we won’t be using MySQL by then but I wouldn’t count on that

You can use supervisor to run your queue and keep it running

https://laravel.com/docs/5.8/queues#supervisor-configuration

This should answer your last question

https://stackoverflow.com/questions/41991251/what-is-the-difference-queuework-and-queuelisten/41991848

You are hitting the y2k bug in mysql. I suspect your column is TIMESTAMP which will only allow up to year 2037. Change to DATETIME if you want to allow further into the future

@HACKROOT - @if ($invoice->gross_total > 0)

Sounds like you need to rethink the relationship. So you are saying you want to attach a product to an invoice several times with a pivot table? That would result in a table like:

Invoice_id    Product_id

1                    3

1                    3

Which would be pointless. No way to query it. I think you need more of an “invoice_item” relationship and invoice hasMany invoice_item, and invoice_item hasOne product

@FORTEIRP - Let’s see your show method (function) in your controller so we can see what you are doing.

Are you saying you don’t want any html formatting stored in the database?? Then just don’t use a rich text editor and use a plain text area instead

@FORTEIRP - Ok that looks correct. You must be doing something between retrieving from the database and outputting

Let’s see your @show() method

@FORTEIRP - The database looks correct. It should have tags if you are using a rich text editor. Then when you show it in your view as {!!$post->body!!} it should render as html

@FORTEIRP - No I mean in phpmyadmin if you double click on a cell with the tags in it it should turn into a textarea so you will see exactly what is in there

And I just don’t understand why it isn’t $post->body instead of $post->body_html. Are you doing some processing on the content before sending it to the view??

@FORTEIRP - I just notice your column is called body but you are outputting body_html. What is going on there?

You’re still seeing it rendered in the browser on phpmyadmin. Click on one of the bad fields so it displays in an unformatted text box and see how it looks

@FORTEIRP - look at the raw text in the database and see if it is encoded or not. I see your text is still formatted as though it is wrapped in the correct tags but also has encoded tags too.

You should create a relationship if you haven't already then:

$secondpost = DB::table('posts')
        ->with(['images'=>function($q){$q->first();}])
        ->orderBy('id', 'desc')
        ->skip(1)
        ->take(8)
        ->get();
return view('pages.index', compact('firstp', 'secondpost', 'fph'));

@foreach ($secondpost as $secondp)
  <div class="col-lg-3 col-md-3 col-sm-6 col-xs-6 post-ab">
              <div class="row">
                  <img src="{{url($secondp->images->filename)}}" class="imgpost" alt="">
                <div class="bottomleft">
                  <p class="ab-desc">{{$secondp->marca}} {{$secondp->model}}</p>
                  <p class="ab-desc">{{$secondp->pret}} Eur</p>
                </div>
              </div>
            </div>
 @endforeach

Relationship would be in your Post model and be something like...

     public function images()
    {
        return $this->hasMany(\App\PostImage::class);
    }

Because it is a 500 error it will not be the laravel log file, it will be your server log file

@AJITHLAL - did you try adding $img->destroy(); to see if that helps?

Other than that you may have to look at the error logs to see what the reason for the 500 is

Post your code - maybe you are performing so many transformations even 1000MB isn't enough memory.

Also try freeing up memory immediately after save

$img->save('image.jpg'); $img->destroy();

have you checked phpinfo() to see if your settings are being recognised? Reloaded server etc..? Oh...and you do have enough ram too?

@NASH - oh no...I wonder how many sites are out there unknowingly missing a few posts because of that little bit of awkwardness!

@NASH - What I mean is I am getting all results and it is correctly excluding those rows where foo=bar, but it seems to also exclude rows where foo is null...even though I never asked it to.

Is it normal for Model::where('foo', '!=', 'bar')->get(); to return all results apart from those where foo = bar (obviously) but also to not return results where foo is null??

@NOMGUY - Yes I was just wondering if the issuers one was maybe causing some sort of memory issue causing the local server to panic and reboot so appear down for that page but then back up for any other page. Failing that, it could be the chrome bug so I would eliminate that first by trying in safari or FF

You can pass in the model too.

Well the error you are getting suggests that there is no site at that domain so is it not just that your local server is temporarily down?

Can you load the home page at the same time as getting that error?

Can you try it in a different browser - chrome used to have a bug that caused that too

Is your site actually running on that address? Is it not just that your download link is referencing your localhost setup instead of your domain?

Also those two functions are identical apart from the file name. Why not use one and pass the file name in as an argument

Do all $properties have that property? The first one in the array clearly does but what about the rest? If one has no lot_size the whole thing will fail. In which case you can wrap it in an if isset() statement

@ELEVEN0 - https://stackoverflow.com/questions/16715075/preventing-multiple-clicks-on-button/27471389#27471389

What happens if you dd() the $response before the view?

Post more code

Instead of

Return $comment

Do

Return $comment->comment

Only js disabling the button can totally prevent a second submit. But to avoid unnecessary dB inserts you can pass a unique token (maybe even use the csrf token) on submit. Store it in the session for that visitor in an if statement. Sorry I am on my phone and can’t find the back tick key to do a code sample but something like

If isset( $_SESSION[‘thecsrftoken’]) Redirect back Else set the above session and continue

@PICKAB00 - Yes, as when you use withCount it adds a new “column” with _count appended to the end. So if you did a normal query withCount(‘id’) and dumped it you would see it appears as though there is a column called id_count. This resulting column can then be the subject of a mutator. E.g. getIdCountAttribute()

So in your case guestpaxes will be unaffected by the mutator, but the new column (generated by withCount) “guestpaxes_count” will be affected by the mutator

@PICKAB00 - It’s just the naming convention that makes the mutator recognised as such. So CommentsCount just refers to the property comments_count. So if you are mutating $model->first_name, you would name it getFirstNameAttribute().

The “get” part means you are mutating on retrieval of the property

So to mutate any column in your query you are basically going to do getColumnNameAttribute()...where ColumnName is the actual column_name.

Hope that makes more sense

@LEGENDARYIN - I am not really sure as to why without digging into the laravel core code to see what it does with those properties but I would expect that they may be relative to a namespace in the core where they are used, so perhaps add the first slash would make your reference then be starting from somewhere inside the vendor directory rather than the root of the app. I'll have a little dig now but maybe someone else might be able to give the exact reason.

So if you reference a file/class from within a class which is on namespace "App"...

\App\MyCLass would be referencing a file path of App/App/MyClass

App\MyClass would be referencing a file path of App/MyClass

So basically add the first slash to break out of the current namespace and reference a different one

Just realised that you were talking about the $listen array which is different (also in quotes) which isn't relative to any namespace as I expect that must be the first point they are defined.

Ok...how about trying this?

$result = DB::table('register')
            ->select(['nimi', 'kood'])
            ->selectRaw("MATCH(nimi) AGAINST (? IN BOOLEAN MODE) AS score")
            ->having('score', '>', 0)
        ->setBindings([$term])
            ->orderBy('score', 'desc')
            ->get();