php – Page 22 – Türker Yıldırım

A read-through cache that stampedes exactly once

Deep diveAugust 24, 202210 min read

A cache entry expired at 09:00 and four hundred requests recomputed it. A latency spike every hour, exactly on the hour.

Composer 2.4 and the platform-check you disabled in 2020

NoteAugust 18, 20222 min read

Composer generates a platform_check.php that aborts at autoload time when the running PHP does not satisfy the constraint, and plenty of projects switched it off during the 2.0…

Composer audit, and the advisory that was already fixed

Deep diveAugust 8, 202210 min read

2.4 in August, and an audit command in the tool that already knows. A separate scanner reporting on a lock file it half understood.

A render.php in block.json, from 6.1

NoteAugust 2, 20221 min read

6.1 lets block.json name a PHP file for rendering, which removes the callback from the registration call. The file receives $attributes, $content and $block as variables rather than…

An admin panel that was a security boundary

Deep diveAugust 2, 202210 min read

/admin on the same hostname, behind a login form. A support engineer with the same session cookie as a customer.

A GDPR deletion request across eleven tables

Deep diveJuly 4, 202214 min read

A request arrived and nobody could say where the data was. Personal data in eleven tables, three of them denormalised copies.

Sessions in Redis, and the logout that did not

Deep diveJune 29, 202210 min read

A session store move that changed the security properties. Logging out on one device leaves the others signed in.

Block locking, and the page an editor cannot break

Deep diveJune 29, 20229 min read

6.0, and locking that is per block rather than per template. templateLock all was too much and nothing was too little.

json_decode with JSON_THROW_ON_ERROR, always

NoteJune 21, 20222 min read

Without the flag, a malformed document returns null, which is indistinguishable from a document containing the literal null. The ambiguity is the whole problem: a decode that returns…

A backed enum’s value is a contract once it reaches a queue

NoteJune 21, 20222 min read

An enum serialised into a queued job payload is a value that must still be resolvable when the job runs, which may be after the next deploy. This…