Türker Yıldırım

php

  • Forced scoping on a nested route binding

    Note2 min read

    A nested route binding resolved both models independently, so a request for one customer’s order under another customer’s URL returned the order. The unscoped behaviour is an authorisation…

  • Laravel 9 moved to Symfony 6 and took PHP 8 with it

    Deep dive9 min read

    February, the first annual major, and a version number that means less than it used to. The work is two packages that block everything.

  • Testing a block theme without a browser

    Deep dive10 min read

    A theme with no PHP has nothing a unit test can call, and the only test is a person looking at a page.

  • Laravel 9 accessors are one method rather than two

    Note2 min read

    February’s release replaces the get-and-set method pair with a single method returning an Attribute object. The old syntax still works and is not deprecated, so this is an…

  • Elasticsearch 8 turns security on and removes types

    Deep dive14 min read

    February, and a major that changes the default posture rather than the API. The cluster starts and nothing can connect to it.

  • Intersection types cannot be nullable until 8.2

    Note1 min read

    Pure intersection types in 8.1 mean class and interface types only, which excludes the nullable case that most signatures need. The restriction to class types is what “pure”…

  • An audit log that a lawyer could read

    Deep dive9 min read

    A dispute, and a log that recorded that something changed. “Order updated” with no before, no after and no actor.

  • wp_safe_remote_get, and the SSRF you did not consider

    Note1 min read

    wp_remote_get fetches any URL it is given, including one on the local network, and the safe variant blocks private ranges. The attack is a URL parameter pointing at…

  • A first-class callable binds visibility where it is written

    Note2 min read

    The … syntax produces a Closure bound at the point of creation, which means a private method can be handed out and will still work wherever it is…

  • The 8.x client refuses a 7.x cluster, deliberately

    Note2 min read

    The official clients check a product header and refuse to talk to anything that is not the version they expect, which makes a rolling upgrade a coordinated one.…