php – Page 22 – Türker Yıldırım

A render.php in block.json, from 6.1

NoteAugust 2, 20221 min read

6.1 lets block.json name a PHP file for rendering, which removes the callback from the registration call. The file receives $attributes, $content and $block as variables rather than…

An admin panel that was a security boundary

Deep diveAugust 2, 202210 min read

/admin on the same hostname, behind a login form. A support engineer with the same session cookie as a customer.

A GDPR deletion request across eleven tables

Deep diveJuly 4, 202214 min read

A request arrived and nobody could say where the data was. Personal data in eleven tables, three of them denormalised copies.

Sessions in Redis, and the logout that did not

Deep diveJune 29, 202210 min read

A session store move that changed the security properties. Logging out on one device leaves the others signed in.

Block locking, and the page an editor cannot break

Deep diveJune 29, 20229 min read

6.0, and locking that is per block rather than per template. templateLock all was too much and nothing was too little.

json_decode with JSON_THROW_ON_ERROR, always

NoteJune 21, 20222 min read

Without the flag, a malformed document returns null, which is indistinguishable from a document containing the literal null. The ambiguity is the whole problem: a decode that returns…

A backed enum’s value is a contract once it reaches a queue

NoteJune 21, 20222 min read

An enum serialised into a queued job payload is a value that must still be resolvable when the job runs, which may be after the next deploy. This…

Block locking is per block, not per template

NoteJune 21, 20221 min read

6.0 adds a lock attribute on individual blocks, which sits between templateLock on a container and no restriction at all. The two flags are independent, so a block…

static::class inside a trait resolves to the using class

NoteJune 9, 20222 min read

A trait is copied into the using class at compile time, so self, static and __CLASS__ all refer to the class rather than to the trait. This is…

client_max_body_size, and the upload that 413s

NoteJune 6, 20222 min read

Four separate limits govern an upload and the error message names only the one that fired, which is usually not the one you changed. The PHP limit failing…