DunglasTorControlBundle, TorControl Symfony integration

I’ve just released a new Symfony bundle to use easily the PHP TorControl library with the framework. TorControl is a library I’ve wrote designed to control a Tor server using the control socket.

Install the bundle using Composer. Type this command in your Symfony project directory:

composer require dunglas/torcontrol-bundle:dev-master

Enable the bundle, edit your app/config.yml to match your Tor server configuration (look at the README.md file) and get a TorControl instance using the Symfony’s service container. In a controller implementing the ContainerAware interface:

$tc = $this->get('torcontrol');

As usual, you can download the bundle and its documentation on GitHub.

PHP TorControl, a library to control TOR

Tor logo

I have just released TorControl, a PHP library to control a Tor server.

This library implements the Tor Control protocol.

It supports:

  • Connect to a Tor server through network socket, SSL network socket or UNIX socket
  • Null, password and cookie file authentication methods
  • Automatic authentication for null and cookie file methods
  • Multi-line replies

It is unit-tested with PHPUnit and and installable with Composer.

Download it, see examples and read the doc on the GitHub repository of the library.

A Symfony bundle is also available.

A Symfony 2 TodoMVC implementation using Backbone.js and Chaplin.js

I have just released an implementation of TodoMVC using Symfony 2 (the best PHP framework), Chaplin.js and Backbone.js. It follows my previous article on the use of these technologies (in french).

TodoMVC is a project which offers the same Todo application implemented using MV* concepts in most of the popular JavaScript MV* frameworks of today.

This a backend and frontend implementation of this project. It is a demo of Chaplin and Backbone working with Symfony.
Screenshot Symfony Todomvc

 

My bundle includes a JSON REST API built with FOSRestBundle and the Symfony’s form framework, the Doctrine entitiy, the view to load the SPA, the CoffeeScript code and some functional tests.

Try the demo and download it on GitHub.

French version of this article.

 

Tag Suggestion for symfony

I just have created a patch for sfFormExtraPlugin. It provides a new form widget called sfWidgetFormJqueryTagSuggestion designed to suggest tags. It is based on the Tag Suggestion jQuery plugin of Remy Sharp.

Capture d'écran

You can download it from GitHub, just copy the files to the corresponding directories of your existing sfFormExtraPlugin installation or wait for upstream inclusion of my patch.

This widget integrates easily with sfPropelActAsTaggableBehaviorPlugin. Here is how to use it with this plugin.

You must have sfFormExtraPlugin with my patch and sfPropelActAsTaggableBehaviorPlugin properly installed and working. We consider that you have a model called Article with the taggable behavior.

Add jQuery to your javascripts

Like many others sfFormExtraPlugin widgets, the sfWidgetFormJqueryTagSuggestion requires jQuery to work. If you already have it installed, you can skip this step. Either, download jQuery to the
web/js/

directory of your project, open the
config/view.yml

file of your application and set it like that:

Of course, change the filename if needed.

Put Javascripts and CSS into your web directory

sfFormExtraPlugin need some CSS and Javascripts to work properly, run the symfony plugin:publish-assets command to put them into corrects directories.

Create a static function to retrieve matching tags

Its time to extend the TagPeer model class to add it a method allowing to retrieve tags corresponding to a query. Creates a new file called MyTagPeer.class.php into the
lib/model/

directory of your project containing the following code:

Do not forget to run symfony cc to clear the cache after that.

Create a controller method to send the result as JSON

We have the model, we need the controller. Create a new module called tag by running symfony generate:module yourapp tag and add the following method to the tagActions class:

Open your
routing.yml

file and add the following line to be able to access this action:

Modify your form to add the new tags suggestion widget

Open the form class you want to add this widget and add the following line to the end of the configure method:

We use the comma as separator instead of the space by default because this is the separator used by sfPropelActAsTaggableBehaviorPlugin.

Next, modify your call to the form in your actions to pass the AJAX URL as form option:

It’s done!

Patch to use sfXssSafePlugin with symfony 1.2

HTML Purifier is a awesome PHP filter library designed to secure and add standard compliance to HTML. In websites including user generated content, this library allow to have mutlimedia pages including image, text formating and YouTube videos in a secure and SEO proof way thanks to rich text editors like Tiny MCE or FCK Editor and HTML purifier.

A plugin called sfXssSafePlugin is designed to integrate this library as an escapement strategy in symfony. If you have tried it with symfony 1.2 you can see this message:

HTML Purifier autoloader registrar is not compatible
with non-static object methods due to PHP Bug #44144;
Please do not use HTMLPurifier.autoload.php (or any
file that includes this file); instead, place the code:
spl_autoload_register(array(‘HTMLPurifier_Bootstrap’, ‘autoload’))
after your own autoloaders.

There are also some strict standards and constants compatibility problems. I’ve just wrote a patch to get this plugin working with symfony 1.2.

  1. Install sfXssSafePlugin like described in its README file
  2. Download my patch in the plugin’s folder
  3. Go into the plugin’s folder and run patch lib/helper/XssSafeHelper.php < XssSafeHelper.php.patch
  4. Edit your application configuration file (ie:
    apps/frontend/config/frontendConfiguration.class.php

    ) and add the following code into the configure() method:

It’s done ! I’ve submitted this patch to the plugin’s author. I hope it will be upstream soon :)

Feedburner: Switching to Google account with MyBrand enabled

Since I’ve migrated my FeedBurner account to Google I encounter a lot of problems, especially with the MyBrand service. MyBrand is a service allowing to use custom domain names with FeedBurner. Instead of something like http://feeds.feedburner.com/lapin-blanc, your feed address become http://feeds.lapin-blanc.net/lapin-blanc. I’ve already explained why it’s better !

My subdomain for feeds was rss.lapin-blanc.net. There is no way to get this subdomain working since I’ve switched to Google accounts. I’ve followed the Tim Heuer’s tutorial but the message The domain “rss.lapin-blanc.net” you specified is already in use. is still displayed when I try to recreate my main custom URL in the MyBrand settings page. I’ve just managed to get my “backup” domain called feeds.lapin-blanc.net working.

So I’ve created this quick-and-dirty hack:

  1. Set a working MyBrand domain. For me: feeds.lapin-blanc.net.
  2. Point the DNS entry of your primary feeds domain on your web server. For me me: replace rss 10800 IN CNAME <my-login>.feedproxy.ghs.google.com. by rss 10800 IN CNAME www.
  3. Create a virtual host on your web server to redirect permanently the old addresses to the new one. For me (using Debian GNU/Linux):
    Create a file called /etc/apache2/sites-available/rss.lapin-blanc.net containing:

    Next type in a shell a2ensite rss.lapin-blanc.net && /etc/init.d/apache2 reload.
  4. Change all occurrences of your old feeds URL to the new in your site to reduce the number of HTTP requests.

Your burned feed must work without losing readers. This a temporary solution, and I think that the only useful long term solution is to go away from FeedBurner

Build your own website thumbnail generator with Django

On many website you can see a awesome link preview effect using a thumbnail of the page. There is some web services such as Websnapr or Thumbalizr providing an API to make your own webpages screenshots but it can be annoying to rely on third party projects: free accounts can only display a small among of screenshots and, cannot customize the size of the image, you cannot render Flash animations or Javascript…

Webkit Logo

We will build a website thumbnail generator using CutyCapt, a Webkit based free software designed to make screenshots of web pages, and Django, the powerful Python web framework.

The first step is to download and install CutyCapt. On a Debian-based system (such as Ubuntu) just type the following commands:

Try to open the
example.png

(i.e: eog example.png), if the install is OK you must see a screenshot of this blog.

I assume your Django installation is working fine. Start a new project if needed (django-admin.py startproject mysite) and create an application called
webthumb

with python manage.py startapp in your project.

Django Reinhardt

Edit your
urls.py

file to add a new pattern to the tuple urlpatterns. It will match screenshots requests and call the thumb view:

Now create a view called thumb in
webthumb/view.py

with this code:

Adapt the variables CUTYCAPT and THUMBS_DIR with your settings. Of course the directory pointed by THUMBS_DIR must be writeable (chmod 777).

You can now embed website thumbnails in your websites just with this HTML markup <img src="http://localhost/thumb/http://lapin-blanc.net" alt="Lapin Blanc" />.

Enjoy !

The last update of Aptana block Django development server

The last update of Aptana Studio come with a new built-in Jetty-based HTTP server running on port 8000… the same as Django development server. There is no good way to disable the preview server feature of the popular editor, but our favorite web framework can be launched on another port. Just type python manage.py runserver 8080 instead of python manage.py and access to your work on
http://localhost:8080

.

Django logo

MessengerFX’s security problem corrected

Some times ago I found a Cross Site Scripting vulnerability in MessengerFX, a popular web-based Windows Live Messenger client. Friday I received from the team saying that the problem is now corrected:

Hi Kevin,
First of all i want to thank you for your warn. We fixed that problem and
now its working correctly.

[...]
If you find any other problem please let me know. Thanks again.

It was serious : Every software’s feature is available through Javascript. Any contact of a MessengerFX user can crash his browser, and futhermore get its contact list, add, remove, ban and unban contacts, read and send messages to any other contact of the victim ! Basically, an attacker just need to be listed in the contacts list of an MessengerFX user and this attacker can take control over the account.

In fact, all Javascript code is now removed server-side, so it’s impossible to send some snippets to a friend and the code is still executed locally (in the browser of the sender). The team explain that a new version of their app will be released soon and will better handle things like this.

hosting.py 0.2 released

hosting.py is a web server account manager for Debian GNU/Linux and derivatives, such as Ubuntu Linux I am maintaining.

I am proud to announce that the version 0.2 is out !

hosting.py now supports MySQL accounts and databases management and his core is modular. The documentation as been rewrited and detailled.

hosting.py needs contributors. Testers and developers are wanted.

Downloads and details on Google Code.