hidden in plain site – joomla! hidden secrets for code monkeys

35
Hidden in plain site Joomla! hidden secrets for code monkeys

Upload: nicholas-dionysopoulos

Post on 30-Jul-2015

475 views

Category:

Technology


5 download

TRANSCRIPT

Page 1: Hidden in plain site – joomla! hidden secrets for code monkeys

Hidden in plain siteJoomla! hidden secrets for code monkeys

Page 2: Hidden in plain site – joomla! hidden secrets for code monkeys
Page 3: Hidden in plain site – joomla! hidden secrets for code monkeys

Junior Dev Stuff

Page 4: Hidden in plain site – joomla! hidden secrets for code monkeys

Input

$app = JFactory::getApplication();$option = $app->input ->getCmd(‘option’);

Page 5: Hidden in plain site – joomla! hidden secrets for code monkeys

File uploads with security check

$app = JFactory::getApplication();$option = $app->input->files ->get('file', array());

Page 6: Hidden in plain site – joomla! hidden secrets for code monkeys

File uploads without security check

$app = JFactory::getApplication();$option = $app->input->files ->get('file', array(), 'raw');

Page 7: Hidden in plain site – joomla! hidden secrets for code monkeys

Date and Time

$dateString = '2015-05-31 12:00:00'; $date = JFactory::getDate($dateString); $format = JText::_('DATE_FORMAT_LC2');echo $date->format($format);

Page 8: Hidden in plain site – joomla! hidden secrets for code monkeys

URI manipulation

$uri = JUri::getInstance();$uri->setVar('joomla', 'rocks'); echo $uri->toString();

Page 9: Hidden in plain site – joomla! hidden secrets for code monkeys
Page 10: Hidden in plain site – joomla! hidden secrets for code monkeys

Serious low-level stuff

Page 11: Hidden in plain site – joomla! hidden secrets for code monkeys

$http = JHttpFactory::getHttp();$response = $http->get('http://www.joomla.org/download.html'); $this->out("HTTP Code: " . $response->code); $this->out("Headers:\n" . print_r($response->headers, true));

HTTP Transferswithout the pain of cURL and stream contexts

Page 12: Hidden in plain site – joomla! hidden secrets for code monkeys

$stream = new JStream();$stream->open(JPATH_SITE . '/tmp/temp.gz', 'w', false, null, false, false, true); $stream->write($buffer);$stream->chmod();$stream->close();

Stream file I/Owith transparent GZip / BZip2 support

Page 13: Hidden in plain site – joomla! hidden secrets for code monkeys

JArchive::extract($archiveName, $targetFolder);

Extract archiveszip, tar, tar.gz / tgz, tar.bz2 / tbz

Page 14: Hidden in plain site – joomla! hidden secrets for code monkeys

JStringPunycode::emailToPunycode('üser@êxαmpłe.com'); // ü[email protected]::urlToPunycode('http://www.παράδειγμα.com'); // http://www.xn--hxajbheg2az3al.comJStringPunycode::fromPunycode('http://www.xn--hxajbheg2az3al.com'); // http://www.παράδειγμα.com

UTF-8 Domainsa.k.a. “Punycode” or IDNA conversion

Page 15: Hidden in plain site – joomla! hidden secrets for code monkeys

$image = new JImage(__DIR__ . '/image.jpg'); $image->createThumbs([ '640x480', '320x200', '160x100', ‘80x50' ], JImage::SCALE_FILL, __DIR__ . '/thumbs');

Image manipulationThumbnails

Page 16: Hidden in plain site – joomla! hidden secrets for code monkeys

$image = new JImage(__DIR__ . '/image.jpg'); $newImage = $image ->filter('grayscale') ->rotate('10', 0xFFFFFF, true) ->resize(320, 200);$newImage->toFile( __DIR__ . ‘/altered.png', IMAGETYPE_PNG );

Image manipulationAlter and convert images

Page 17: Hidden in plain site – joomla! hidden secrets for code monkeys

Files and databases

Page 18: Hidden in plain site – joomla! hidden secrets for code monkeys

GitHub integration JGithub

Page 19: Hidden in plain site – joomla! hidden secrets for code monkeys

$patcher = JFilesystemPatcher::getInstance();$patcher ->reset() ->addFile( __DIR__ . ‘/file1.patch', JPATH_BASE, 1 ); $patcher->apply();

Apply patch filesJFilesystemPatcher

Page 20: Hidden in plain site – joomla! hidden secrets for code monkeys

$schemaUpdater = JSchemaChangeset::getInstance( $db, '/path/to/sql/files' );

$errors = $schemaUpdater->check();

$schemaUpdater->fix();

Update the schema or get a list of errors (changes not applied)

Page 21: Hidden in plain site – joomla! hidden secrets for code monkeys

$config = [ 'dbinstaller_directory' => '/path/to/xml/files', 'option' => 'com_example'];

$schemaUpdater = new FOFDatabaseInstaller($config);

// Install or update schema$schemaUpdater->updateSchema();

// Remove the schema$schemaUpdater->removeSchema();

XML-based schema updatesusing FOFDatabaseInstaller

Page 22: Hidden in plain site – joomla! hidden secrets for code monkeys

$db = JFactory::getDbo();$exporter = $db->getExporter();$xml = $exporter->asXml();

Exporting the database Here Be Dragons!

Page 23: Hidden in plain site – joomla! hidden secrets for code monkeys

$db = JFactory::getDbo();$importer = $db->getImporter();$importer->from($xml); // Bug: mergeStructure is protected. Sad panda :(// $importer->mergeStructure();$reflection = new ReflectionObject($importer);$method = $reflection->getMethod('mergeStructure');$method->setAccessible(true); $method->invoke($importer);

Importing the database Here Be Dragons!

Page 24: Hidden in plain site – joomla! hidden secrets for code monkeys

Dial the awesome to eleven!

Page 25: Hidden in plain site – joomla! hidden secrets for code monkeys

Services Lots of!

Page 26: Hidden in plain site – joomla! hidden secrets for code monkeys

JFacebook JLinkedin

JGoogle JTwitter

JMediawiki JOpenstreetmapJOauth1ClientJOauth2Client

Services Lots of!

Page 27: Hidden in plain site – joomla! hidden secrets for code monkeys

CryptographyJKeychain & JCrypt

• 3DES

• Blowfish

• Rijndael256 (AES)

• Simple (don’t use)

• mcrypt

Page 28: Hidden in plain site – joomla! hidden secrets for code monkeys

// Set up$plugin = JFactory::getApplication()->getParams() ->get('captcha', JFactory::getConfig()->get('captcha'));$captcha = JCaptcha::getInstance($plugin, array( 'namespace' => 'myComponent'));// Showecho $captcha->display('mycaptcha', 'mycaptcha'); // Validate$code = JFactory::getApplication()->input->get('mycaptcha'); if (!$captcha->checkAnswer($code)){ throw new RuntimeException('Bots not welcome', 403); }

CAPTCHAKeep bots away

Page 29: Hidden in plain site – joomla! hidden secrets for code monkeys

$less = new JLess();$less->ccompile($lessFile, $cssFile);

Compile LESS to CSSServer-side, cached

Page 30: Hidden in plain site – joomla! hidden secrets for code monkeys

$pathway = JFactory::getApplication() ->getPathway();$pathway->addItem('MyItem', $url);

Manipulate breadcrumbsCustom, in-component pathways

Page 31: Hidden in plain site – joomla! hidden secrets for code monkeys

MicrodataSchema.org support

https://docs.joomla.org/Microdata

Page 32: Hidden in plain site – joomla! hidden secrets for code monkeys

More than a CMSCustom application types

• JApplicationCLI

• JApplicationWeb

• JApplicationDaemon

Page 33: Hidden in plain site – joomla! hidden secrets for code monkeys

Photos by Smithsonian Institution, National Museum of American History

Page 34: Hidden in plain site – joomla! hidden secrets for code monkeys

May the Core

be with you

Page 35: Hidden in plain site – joomla! hidden secrets for code monkeys

The End