Roadmap Version 1.8

I am running ipadrank on PHP v.5.5.18 but dont see any problems that should come up with 5.6. If anything comes up I can help fix straight away

 

So far, so good. Additionally, I saw a 56% increase in speed (which I can only imagine is a fluke, so I'll have to monitor it). Front page load time went from 0.684 sec to 0.304 sec. Hope the server doesn't start on fire from going so fast

 

I have heard a lot of good things about the recent php developments and the direction of the language. Looks like they might be helping us. Good to hear. Keep a fire extinguisher handy just in case

 

This is cool (if it works): https://blackfire.io. I can't install it in a shared hosting environment, but I'd be very interested to see what recommendations it has on the current build.

 

One of the recommendations from running Google's PageSpeed Insights against my site was to minify HTML. (Hotaru already minifies Javascript and .css.) According to PageSpeed, the result of minifying HTML would be a 10% file size reduction. Something to consider for future versions might be to incorporate something like HTML Minify for Wordpress.

 

I recently had a user post a suggestion that she wanted a user tagging/mention feature similar to Facebook. I created some code that basically takes in some content (posts or comments), searches for potential usernames that start with /u/, modifies the content to replace those usernames with links to the profile, and then sends a message to the user indicating they were mentioned. This isn't the exact code (because it includes some very specific customizations to my build), but you should be able to get the general idea if you want to do something similar for future versions:

Code:

    // look for /u/username
     preg_match_all("|\W\/u\/(\w+)|mi", $content, $potential_users);
     if (!$potential_users[1]) { return $content; }

     $potential_users = array_unique($potential_users[1]);

     // CODE TO CHECK FOR USERS GOES HERE AND, IF FOUND, RETURNS $multiple_users

     $found_users = array();

     foreach ($potential_users as $user)
     {
       if ($multiple_users[$user])
       {
         $user_url = '<a href="' . BASEURL . 'user/' . $user . '">/u/' . $user . '</a>';
         $pattern = "|(\/u\/" . $user . ")|mi";

         $content = preg_replace($pattern, $user_url, $content);
         $found_users[] = $user;
       }

     return $content;
     }

What I realized after testing this is that, when many users have elected to have emails sent to them when they get messages, it takes a long time for PHPMailer to send each email. So I also created some code to send all email notifications except for a select few (e.g., password changes, email changes, registration confirmations) to a email queuing table. Then I have a cron job run every 5 minutes to send out whatever's in the queue. This is slightly more convoluted code (as my messaging functionality is pretty messy), but here's the general idea...

The table looks like this:

Code:

    $add_tables = array
     (
       array("table_name" => "outbound_email_queue",
       "fields" =>
       "`email_queue_id` int(11) NOT NULL AUTO_INCREMENT,
       `email_date_queued` timestamp DEFAULT CURRENT_TIMESTAMP,
       `email_sent` tinyint(1) DEFAULT '0',
       `email_created_by` int(11) DEFAULT '0',
       `email_fromname` text,
       `email_addbcc` text,
       `email_subject` text,
       `email_body` text,
       `email_date_sent` timestamp,
       PRIMARY KEY (`email_queue_id`),
       KEY `mod_active` (`email_sent`)",
       "table_comment" => "To queue emails for sending via cron")
     );

Then I modified function doSmtpEmail in /libs/EmailNotifications so that it comes in with $queue (and all the calling functions) and the bottom looks something like this (again, this isn't exactly the way it looks, but you'll get the idea):

Code:

     $sql = "INSERT INTO ". DB_PREFIX . "outbound_email_queue SET email_created_by = %d, email_fromname = %s, email_addbcc = %s, email_subject = %s, email_body = %s";
     $h->db->query($h->db->prepare($sql, $h->currentUser->id, urlencode($mail->FromName), serialize($this->to), urlencode($mail->Subject), urlencode($mail->Body)));
     $last_insert_id = $h->db->get_var($h->db->prepare("SELECT LAST_INSERT_ID()"));

     // if queue = false, send immediately (e.g., for email validation)
     if (!$queue)
     {
       if(!$mail->send()) { $h->messages[$h->lang('something_went_wrong')] = "red"; }
       else
       {
         $sql = "UPDATE ". DB_PREFIX . "outbound_email_queue SET email_sent = %d, email_date_sent = CURRENT_TIMESTAMP WHERE email_queue_id = %d";
         $h->db->query($h->db->prepare($sql, 1, $last_insert_id));
       }
     }

Finally, I set up a cron to run something that looks like this:

Code:

  public function CronSendEmail($h)
   {
     $sql = "SELECT * FROM " . DB_PREFIX . "outbound_email_queue WHERE email_sent = %d";
     $queued_emails = $h->db->get_results($h->db->prepare($sql, 0));

     if (!$queued_emails) { return false; }

     require_once EXTENSIONS. 'phpMailer/PHPMailerAutoload.php';
     $mail = new \PHPMailer();

     $mail->isSMTP();  // Set mailer to use SMTP
     $mail->Host = SMTP_HOST;       // Specify main and backup SMTP servers
     $mail->SMTPAuth = true;  // Enable SMTP authentication
     $mail->Username = SMTP_USERNAME;  // SMTP username
     $mail->Password = SMTP_PASSWORD;  // SMTP password
     $mail->SMTPSecure = 'tls';  // Enable TLS encryption, `ssl` also accepted
     $mail->Port = SMTP_PORT;  // TCP port to connect to
     $mail->CharSet = 'UTF-8';
     $mail->IsHTML(true);
     $mail->From = SITE_EMAIL;

     foreach ($queued_emails as $email)
     {
       $bcc_array = unserialize($email->email_addbcc);

       foreach ($bcc_array as $bcc)
       { $mail->AddBCC($bcc); }

       $mail->FromName = urldecode($email->email_fromname);
       $mail->Subject = urldecode($email->email_subject);
       $mail->Body = urldecode($email->email_body);

       if(!$mail->send()) {
         // error message handling goes here
       }
       else
       {
         $sql = "UPDATE ". DB_PREFIX . "outbound_email_queue SET email_sent = %d, email_date_sent = CURRENT_TIMESTAMP WHERE email_queue_id = %d";
         $h->db->query($h->db->prepare($sql, 1, $email->email_queue_id));
       }
     }

     // delete everything in this table older than 1 day:
     $sql = "DELETE FROM " . DB_PREFIX . "outbound_email_queue WHERE email_sent = %d AND DATEDIFF(NOW(), email_date_sent) >= %d";
     $h->db->query($h->db->prepare($sql, 1, 1));
   }

It all works pretty well

 

As I continue to fight with csrf errors, I noticed that line 14 of libs/extensions/csrf/csrf_class.php can probably be:

Code:

$this->action = (!$action) ? $h->getPagename() : $action;

Shouldn't make a difference, but it's a bit cleaner.

 

Lets put together an action team and squash the CSRF issue once and for all

 

To troubleshoot the problem I was fighting with yesterday, I logged the following variables in their respective functions to see what was happening:

• $this->action in csrfInit
• $newToken in csrfKey
• $_SESSION[$unique_form_name] and $token_value in csrfguard_validate_token

I learned the problem was caused by my nemesis: Javascript. I have a search box for communities and moderator functions in my build that uses Javascript to pull from the database as each letter is pressed. What was happening (and I'm convinced this is the root of all csrf problems in Hotaru) is line 57 of Hotaru.php ( $this->csrf('set'); ) was regenerating a new csrf every time the Javascript ran. So if a user used the search boxes before pressing submit on whatever page he was on, the csrf had now changed. Thus, the tokens didn't match.

IMO, the best way to fix this would be to only run $this->csrf('set'); when you need a token for a page, rather than always running it at the beginning of each session. Another alternative (and the one I used because I didn't want to rework it everywhere in my build) was to add the following lines in csrfInit:

Code:

    $dont_regenerate_csrf = array('my_Javascript_page');
     if (in_array($this->action, $dont_regenerate_csrf)) { return; }

This way, anytime the page = my_Javascript_page (e.g., mysite.com/index.php?page=myJavascript_page), it will ignore regenerating the new token. You can then add other pages to the array for any that are causing problems.

 

Bootstrap 3.3.5 is out

 

Here are some of the highlights:

• Updated to Normalize.css v3.0.3.
• List groups now support <button> elements.
• Cleaned up some extraneous padding on jumbotrons across various viewports.
• Fixed input group sizing classes on all supported elements for real this time.
• Applied a few tooltip and popover positioning fixes.
• Fixed behavior when using tooltips and popovers that are triggered by multiple events.
• Fixed some memory leakage in the tooltip and popover plugins.
• Fixed incorrect Affix positioning when a webpage has a sticky footer.

 

Yup. And upgraded easily and without problem via your new functionality to just change /libs/Initialize.php

Let's also not forget that PHP 7.0 alpha is out and is up to twice as fast as PHP 5.6! I'm very excited!

 

yes, more words into language files it always better. which theme are you using?

 

I had a user today complain that she spent an hour writing something only to hit submit and lose the content because Hotaru timed out (due the ~30-minute timeout problem we haven't been able to find). I can see this could be a major source of frustration for some users, and rightfully so. So this is how I've worked around the problem until we figure out what's causing it: I've removed the remember checkbox in navigation.php and also user_signin_login.php. I then permanently set $remember = 1 in function login of user_signin.php. Now, even when users close their browsers, it will still be logged in for the 30-day duration of the cookie. It's a temporary fix but wanted to let you all know in case anyone else needs a work-around.

 

The best long term idea would be do an autosave with javascript in the background as they type and save it to the db as a draft. This forum software does that and a lot of sites do as well now.

Also, the latest browsers (google chrome in particular for a while now) have a localstorage system which allows input box content to be saved so if your browser crashes you can reopen and still have the data.

these would be good options in addition to the timeout idea which is also useful

When we started Hotaru is was mainly bookmarking and so the time required to save lengthy content was not an issue. Recently more people are using hotaru for journal or blog type sites so we should definitely look at this and work out a better solution.

 

@shibuya246, not sure if this will be useful or not but it's free to open source projects: StyleCI ? The PHP Coding Style Service.

 

looks interesting
am trying it now

 

I have a travis file included but it is not set up properly
does anyone have experience with travis files?