The report highlights how in order to minimise hash collisions in the event of brute force attacks, the DJBX33A and DJBX33X algorithm use a bit of resource intensive math to make the hashes longer. How could this be a bad thing?

The Problem

Knowing this, a list of values can be precompiled and all uploaded via GET or POST, forcing PHP (or any other interpreter) to compile these values into a hash table. Uploading only 1MB of these values at 70-100kbits per second is all that would be needed to keep an i7 CPU busy for a minute. Theoretically 8MB would take 288 minutes, DoSing the server with only one request.

What can we do to protect ourselves?

PHP natively comes with an upload limit of 8M, and a maximum time for generating the hash table of 1 minute, which could be a worry for these kinds of attacks. When you consider that even these values allow for these kinds of attacks, it is a worry. However when taking into account functions such as user uploads, which may take considerable time for large files, it is hard to keep these limits down. However if working with PHP 5.3.8 and below, unfortunately it is all we have to work with.

Luckily in PHP 5.3.9, a new php.ini directive was introduced, max_input_vars. By restricting the amount of variables that can be parsed into the table, the time spent generating the table is also limited. Defaulting at 1000, we can set this value much lower to only a little bit higher than the maximum amount of parameters we need on any given page in our applications. This should also apply to multidimensional inputs, after being highlighted in this bug.

Don’t take these directives light heartedly. Set them as low as you can afford, to prevent these attacks as well as you possibly can.

Firstly, find out what your theme’s main stylesheet is called, usually style.css. In your theme’s main directory, edit functions.php, and add the following code:

<?php add_editor_style('style.css'); ?>

Load up the page editor, it should resemble the post theme, however you may have a few problems, such as text right on the border, wrong text alignment, etc.

To fix this, add an entry to the bottom of your styles.css file similar to the following:

#tinymce { text-align:left; padding: 10px;}

#tinymce pre, #tinymce code { background: none repeat scroll 0 0 #EEEEEE; border: 1px solid #999999; }

The above is what I have on this site fixing alignment and adding a background to distinguish the code boxes, but you can have any fixes you like to make the editor feel more real. Note that this method only works with the TinyMCE editor (WordPress 3.3) however is still possible to achieve with other css entries with earlier Version 3 installs.

I hope everyone has a safe and Merry Christmas and Happy New Year

The thing that amazed me with jqPlot is the amount of plugins that came with it to do different things. So many different types of charts can be created using this plugin, but by using plugins, the code remains nice and quick, and you only load what you are going to need. And there areplugins for added functionality too. For example you can add trend lines, add a tooltip for where the cursor is, or load external data via ajax.

Creating Graphs

It is easy to use also. After uploading the files you need, all you have to add to your header is:

<script src="jquery.js"></script>
<script src="jquery.jqplot.min.js"></script>
<link rel="stylesheet" type="text/css" href="jquery.jqplot.min.css" />

And were ready to start making pretty graphs

If we add a div to our page to contain the chart:

<div id="chart_container" style="height:400px;width:600px; "></div>

Then we can add the chart generating code to our onload event:

window.onload=function(){
	$.jqplot('chart_container',  [[[1, 2],[2,4],[3,8],[4,16],[5,32],[6,64]]]);
}

And we end up with a nice graph like below.

Customising the Graphs

To make it look a little nicer, we can add a title, axis titles, change colours, change data point markers, pretty much anything we want. For a full list of options, see the core summary at http://www.jqplot.com/docs/files/jqplot-core-js.html. A simple example is shown below:

window.onload=function(){
	$.jqplot('chart_container',  [[[1, 2],[2,4],[3,8],[4,16],[5,32],[6,64]]], {
		title:'Simple jqPlot Example',
		axes:{
			xaxis:{label:'x'},
			yaxis:{min:0, max:75,label:'y'}
		},
		series:[{
			color:'#00cc00',
			label:'y=2^x',
			markerOptions:{style:'filledSquare'}
		}],
		legend:{
			show: true,
			location:'se'
		}
	});
}

Which will give the following more user friendly graph.

I really like this plugin, the graphs look nice and they easily beat tables of data. To get an idea of what is really possible with jqPlot, check out the example page or download the source, and check out the examples folder. It is amazing just how much this plugin can do.

While you will hopefully learn something from going through my code examples, where you will take off is trying to adapt the code to your own creations. Nothing works better than “just doing it.” If you have any questions at all, please, feel free to ask.

I’m going to be assuming you have a basic understanding of PHP and HTML, and Evolution Xtreme installed. I recommend that you use a server such as WampServer on your computer rather than online, as it will make editing much easier.

Throughout this series, we will be making a fairly basic “Inspirational Quotes” module. It will start as a basic page which will output a random quote specified in the module file, and will finish with an admin panel and database usage, catering for user submissions and permissions.

The plan is as follows:

• Post 2 – Module structure
• Post 3 – Using the database
• Post 4 – Creating an admin page
• Post 5 – Creating blocks
• Post 6 – User interaction
• Post 7 – Tidying up

Still interested? Let’s get started.

Before we dive into our module, I want to explain the most common aspects to starting any module. They are access validation and the header.php and footer.php files.

Access validation
These few lines check to see if the module file is being accessed directly rather than through modules.php. Since this is generally not desirable, and only possible if a hacker is looking through files, we simply end on an error message

header.php and footer.php
These files output the header and footer of the page in the theme that the site/user specify. Without these, modules will just appear on a blank background.

For the vast majority of modules, these files are used, and even for the rest, slightly adapted versions of these files are used. They are the fundamentals of creating modules, so get ready to include them in every one you make.

In the next post, I will go through the folder structure of the module, output, and basically just creating something that the user can see. Stay tuned.

I have been waiting for this game to be released for a little over a year now, since I saw it on the front cover of Atomic magazine. And I have to say, it has definitely been worth the wait.

Even though it was released in 2000, last week, I would have still said that my absolute No. 1 favourite campaign was in the original Deus Ex game. But as of Thursday, that has changed. I havent yet finished campaign, bu in my opinion, Deus Ex Human Revolution has gone above and topped it.

The best part of the game is how suspenseful it can be. For example you have to creep slowly through an area littered  with guards, hoping that they don’t hear you. But while stealth elements of the game have been done really well, there is still the choice of making some noise, hoping that you have enough ammo or objects around you. And if that fails, there’s always the option of throwing objects at enemies. There’s nothing funnier than killing a big scary boss with a fire extinguisher thrown to the head

The most surprising part about the game is how real it feels. For example while roaming the streets of Shanghai, you may run across small food shops, with the shopkeeper cooking food and people eating at the bench. If you watch, the shop keeper is actually cooking – throwing in ingredients, stirring, and turning whatever is in the pan over a stove. Small things like this, they all add up, creating a convincing environment which could easily be the world in 16 years.

If you haven’t already, I suggest you obtain Deus Ex Human Revolution. It is an amazing game, and definitely worth the money to buy it.

Instead, here is how you can create a lightweight templating class, which is easy to use and practically unnoticable in the load times.

The Code

We want to create our class, and be able to specify the template directory upon initialisation. We need two variables, one for the template path, and one for the template variables.

<?php

class template_engine{

	public $tpl_data;
	public $tpl_dir;

	function __contruct($dir){
		$this->tpl_dir = $dir;
	}

}

Now we need a way to add our template variables. Nothing fancy for now, we will improve upon this later in the tutorial

function assign($var, $value=null){
	if ($var != ''){
		$this->tpl_data[$var] = $value;
	}

And we want a way to display a template file using the given template vaiables.

function display($template_file){
	if (!empty($this->tpl_data)){
		extract($this->tpl_data, EXTR_REFS);
	}
	include($this->tpl_dir.$template_file);
}

This will allow us to use plain variable names inside the template files as shown below. Note we do not have to unset the variables as they will all be taken care of at the end of the function thanks to PHP’s garbage collection.

<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title><?php echo $site_name; ?></title>
</head>
<body>
<header>
	<h1>Welcome to the <?php echo $tut_title; ?> Tutorial brought to you by <?php echo $site_name; ?></h1>
</header>
</body>
</html>

If this is saved as main.php in the templates/ folder relative to the main file, index.php, we can call the template as follows

<?php

include 'template.class.php';
$tpl = new template_engine('templates/');

$tpl->assign('site_name', 'Kombat Koding');
$tpl->assign('tut_title', 'Lightweight Template Class');

$tpl->display('main.php');

And it will output “Welcome to the Lightweight Template Class Tutorial brought to you by Kombat Koding“.

Too easy, right?

Some more advanced features

At the moment, the class is pretty basic. We can add many more features, but keep in mind we dont want to bloat the class.

Ive added the ability to assign multiple variables at a time, an append function for adding to arrays assigned to the class, a clear variables function, and a function to fetch the template rather than outputting it straight away. I wont be going through the code for these functions, but I will supply the final class and usage below.

<?php

class template_engine{

	public $tpl_data;
	public $tpl_dir;

	function __contruct($dir){
		$this->tpl_dir = $dir;
	}

	function assign($var, $value=null){
		if (is_array($var)){
			foreach ($var as $key=>$val){
				if ($key != '') {
					$this->tpl_data[$key] = $val;
				}
			}
		}else{
			if ($var != ''){
				$this->tpl_data[$var] = $value;
			}
		}
	}

	function append($var, $value=null){
		if (is_array($var)){
            foreach($var as $key=>$val){
                if ($key != ''){
                    if (!@is_array($this->tpl_data[$key])){
            			settype($this->tpl_data[$key],'array');
            		}
					$this->tpl_data[$key][] = $val;
                }
            }
        }else{
            if ($var != ''){
            	if (!isset($this->tpl_data[$var])){
					$this->tpl_data[$var] = array();
				}elseif (!@is_array($this->tpl_data[$var])){
            		settype($this->tpl_data[$var],'array');
            	}
            	$this->tpl_data[$var][] = $value;
			}
        }
	}

	function clear_variables($var=false){
		if (!empty($var)){
			if (is_array($var)){
            	foreach($var as $v){
            		unset($this->tpl_data[$v]);
            	}
			}else{
            	unset($this->tpl_data[$var]);
        	}
		}else{
			$this->tpl_data = array();
		}
	}

	function display($template_file){
		if (!empty($this->tpl_data)){
			extract($this->tpl_data, EXTR_REFS);
		}

		include($this->tpl_dir.$template_file);
	}

	function fetch($template_file){
		if (!empty($this->tpl_data)){
			extract($this->tpl_data, EXTR_REFS);
		}
		ob_start();
		include($this->tpl_dir.$template_file);
		return ob_get_clean();
	}
}

?>

Usage Examples(from forums mobile mod):

$tpl->assign(array(
	'forum_id' => $forum_id,
	'forum_name' => $row['forum_name']
));

$res = $db->sql_query('SELECT p.`privmsgs_id`, p.`privmsgs_type`, p.`privmsgs_subject`, p.`privmsgs_from_userid`, p.`privmsgs_date`, u.`username` FROM `'. PRIVMSGS_TABLE.'` AS p LEFT JOIN `'. USERS_TABLE .'` AS u ON p.`privmsgs_from_userid`=u.`user_id` WHERE p.`privmsgs_to_userid`='.$userinfo['user_id'].' AND p.`privmsgs_type` IN ('. PRIVMSGS_READ_MAIL .','. PRIVMSGS_NEW_MAIL .','. PRIVMSGS_UNREAD_MAIL .') ORDER BY p.`privmsgs_date` DESC LIMIT '.($page*$show).','.$show);
	while($row = $db->sql_fetchrow($res)){
		$tpl->append('msgs',array(
			'id' => $row['privmsgs_id'],
			'type' => $row['privmsgs_type'],
			'subject' => $row['privmsgs_subject'],
			'from' = >$row['privmsgs_from_userid'],
			'from_username' => $row['username'],
			'date' => EvoDate($userinfo['user_dateformat'], $row['privmsgs_date'], $userinfo['user_timezone']),
			'username' => $row['username']
		));
	}
}

$tpl->display('private_messages.php');

I hope that this tutorial or code is useful to you in some way. It is very easy to plug the code into any new project, and can make layout changes during the development phase 100 times easier.

I’ll admit it, I don’t know very much about HTML5 or CSS3. I still naturally code in XHTML, but after seeing SgtLegend put together both the Mobile Mod and BB3 to Xtreme converter themes so simply and quickly using these two languages, I really want to learn, and let both myself and my code benefit from the two. However learning languages takes time… Time that I would normally spend making things would be instead spent reading, testing, doing basic themes, etc… Which I’m not sure I can even be bothered enduring right now.

So what do you guys think? Keep pushing it aside, or bite the bullet and get it over and done with?

Instead of working and doing part time uni, I will be completing full time uni for the next semester. This means more homework, which I am definitely not looking forward to, but at the same time, I will not be working, so there is a chance that I will have more time.

Guess we’ll just have to wait and see…

Now, we had both discussed a mobile mod before, and both agreed that it would take a hell of a lot of work to get it working properly. However we both had a very similar idea pop into our heads at the same time – use Nuke’s core and a custom templating system to create a lite version of the forums. The mod would only cover reading, posting, and some account features, eliminating the complications of introducing modules, other mods, etc. A couple of hours, few coffees and a lightweight HTML5/CSS3 theme away, Forums Mobile was born.

As of right now, the mod covers logging in and out, browsing through forums and posts, reading PMs, and has support for other themes to be made, and not a single line of configuration is to be found… it merely drops straight into your modules/ folder and is ready to use.

While it is not quite ready yet, at the rapid pace we are currently making, hopefully it wont be too long before the mod is ready for use on all Xtreme sites.

For anyone further interested in the topic of Xtreme going mobile, as seen in SgtLegend’s post here and mentioned on his blog, the Tapatalk mobile app is considered for inclusion in Evolution Xtreme 2.0.9e.