豆皮儿

程序员的豆皮

Archive for the ‘programming’ category

学习算法之路

August 21st, 2010

第一阶段：练经典常用算法，下面的每个算法给我打上十到二十遍，同时自己精简代码，

因为太常用，所以要练到写时不用想，10-15分钟内打完，甚至关掉显示器都可以把程序打

出来.

1.最短路(Floyd、Dijstra,BellmanFord)

2.最小生成树(先写个prim,kruscal要用并查集，不好写)

3.大数（高精度）加减乘除

4.二分查找. (代码可在五行以内)

5.叉乘、判线段相交、然后写个凸包.

6.BFS、DFS,同时熟练hash表(要熟，要灵活,代码要简)

7.数学上的有：辗转相除（两行内），线段交点、多角形面积公式.

8. 调用系统的qsort, 技巧很多，慢慢掌握.

9. 任意进制间的转换

第二阶段：练习复杂一点，但也较常用的算法。

如：

1. 二分图匹配（匈牙利），最小路径覆盖

2. 网络流，最小费用流。

3. 线段树.

4. 并查集。

5. 熟悉动态规划的各个典型：LCS、最长递增子串、三角剖分、记忆化dp

6.博弈类算法。博弈树，二进制法等。

7.最大团，最大独立集。

8.判断点在多边形内。

9. 差分约束系统.

10. 双向广度搜索、A*算法，最小耗散优先.

类与对象(PHP5)之十二：对象克隆(Object cloning)

August 2nd, 2010

通过完全地复制属性创建一个对象的拷贝不是通常想要的行为。需求的一个好的实例适合于拷贝构造函数，
如果有一个对象描述一个GTK窗口和对象保存这个GTK窗口的资源，当你创建一个副本，你或许想创建一个相同的属性新窗口使用和保存新对象资源的新窗口。另一个例子是当你复制父对象时如果保存一个引用给另一个对象，你想创建其他类的一个新实例来分开拷贝所属的复制品。一个对象的拷贝是使用clone关键字来创建的(如果可能的话可以调用对象的__clone()方法)，一个对象的__clone()方法不能被直接声明。
PHP代码如下:

$copy_of_object = clone $object;

当一个对象被克隆时，PHP5将执行一个所有对象的属性的浅拷贝。任何对其它变量引用的属性将只保留引用。如果一个__clone()方法被定义，然后重新创建一个对象的克隆方法来允许任何必需的属性当它需要被改变时调用。
例子 19-30. 克隆一个对象
PHP代码如下:

instance=++self::$instances;  }
public function __clone() {  $this->instance=++self::$instances;  }
}
class MyCloneable
{   public $object1;
public $object2;
function __clone()
{
$this->object1=clone($this->object1);//Force a copy of this->object,otherwise it will point to same object.
}
}
$obj = new MyCloneable();
$obj->object1 = new SubObject();
$obj->object2 = new SubObject();
$obj2 = clone $obj;
print("Original Object:\n");
print_r($obj);
print("Cloned Object:\n");
print_r($obj2);
?>

上例将输出：

Original Object:
MyCloneable Object
(
[object1] => SubObject Object
(
[instance] => 1
)
[object2] => SubObject Object
(
[instance] => 2
)
)
Cloned Object:
MyCloneable Object
(
[object1] => SubObject Object
(
[instance] => 3
)
[object2] => SubObject Object
(
[instance] => 2
)
)

来源：http://www.phpchina.com/html/63/n-1263.html

No comments »

Posted in php, programming, 分享

Tags: php

软件架构师应该知道的97件事

July 21st, 2010

《软件架构师应该知道的97件事》

97 Things Every Software Architect Should Know – Collective Wisdom from the Experts

By Richard Monson – Haefel

ISBN 978-7-121-10635-4

1. 客户需求重于个人简历

2. 简化根本复杂性，消除偶发复杂性

3. 关键问题可能不是出在技术上

4. 以沟通为中心，坚持简明清晰的表达方式和开明的领导风格

5. 架构决定性能

6. 分析客户需求背后的意义

7. 起立发言

8. 故障终究会发生

9. 我们常常忽略了自己在谈判

10. 量化需求

11. 一行代码比五百行架构说明更有价值

12. 不存在放之四海皆准的解决方案

13. 提前关注性能问题

14. 架构设计要平衡兼顾多方需求

15. 草率提交任务是不负责任的行为

16. 不要在一棵树上吊死

17. 业务目标至上

18. 先确保解决方案简单可用，再考虑通用性和复用性

19. 架构师应该亲力亲为

20. 持续集成

21. 避免进度调整失误

22. 取舍的艺术

23. 打造数据库堡垒

24. 重视不确定性

25. 不要轻易放过不起眼的问题

26. 让大家学会复用

27. 架构里没有大写的“I”

28. 使用“一千英尺高”的视图

29. 先尝试后决策

30. 掌握业务领域知识

31. 程序设计是一种设计

32. 让开发人员自己做主

33. 时间改变一切

34. 设立软件架构专业为时尚早

35. 控制项目规模

36. 架构师不是演员，是管家

37. 软件架构的道德责任

38. 摩天大厦不可伸缩

39. 混合开发的时代已经来临

40. 性能至上

41. 留意架构图里的空白区域

42. 学习软件专业的行话

43. 具体情境决定一切

44. 侏儒，精灵，巫师和国王

45. 向建筑师学习

46. 避免重复

47. 欢迎来到现实世界

48. 仔细观察，别试图控制一切

49. 架构师好比两面神

50. 架构师当聚焦于边界和接口

51. 助力开发团队

52. 记录决策理由

53. 挑战假设，尤其是你自己的

54. 分享知识经验

55. 模式病

56. 不要滥用架构隐喻

57. 关注应用程序的支持和维护

58. 有舍才有得

59. 先考虑原则，公理和类比，再考虑个人意见和口味

60. 从“可行走骨架”开始开发应用

61. 数据是核心

62. 确保简单问题有简单的解

63. 架构师首先是开发人员

64. 根据投资回报率（ROI）进行决策

65. 一切软件系统都是遗留系统

66. 起码要有两个可选的解决方案

67. 理解变化的影响

68. 你不能不了解硬件

69. 现在走捷径，将来付利息

70. 不要追求“完美”，“足够好”就行

71. 小心“好主意”

72. 内容为王

73. 对商业方，架构师要避免愤世嫉俗

74. 拉伸关键维度，发现设计中的不足

75. 架构师要以自己的编程能力为依托

76. 命名要恰如其分

77. 稳定的问题才能产生高质量的解决方案

78. 天道酬勤

79. 对决策负责

80. 弃聪明，求质朴

81. 精心选择有效技术，绝不轻易放弃

82. 客户的客户才是你的客户！

83. 事物发展总会出人意料

84. 选择彼此间可协调工作的框架

85. 着重强调项目的商业价值

86. 不仅仅只控制代码，也要控制数据

87. 偿还技术债务

88. 不要急于求成

89. 打造上手（Zuhanden）的系统

90. 找到并留住富有激情的问题解决者

91. 软件并非真实的存在

92. 学习新语言

93. 没有永不过时的解决方案

94. 用户接受度问题

95. 清汤的重要启示

96. 对最终用户而言，界面就是系统

97. 优秀软件不是构建出来的，而是培育起来的

No comments »

Posted in programming, 分享

This is a c hello world

April 12th, 2010

#include 

int n[]={
0x48, 0x65,0x6C,0x6C,
0x6F,0x2C,0x20,
0x77,0x6F,0x72,
0x6C,0x64,0x21,
0x0A,0x00},*m=n;
main(n){
    if(putchar (*m)!='\0') main(m++);
}

No comments »

Posted in programming, 分享

国外主流PHP框架比较-CodeIgniter、CakePHP、ZendFramework、Symfony

January 7th, 2010

来源：http://www.phpchina.com/index.php?action-viewnews-itemid-35342

最近简单的使用了目前在国内用的比较多的几个主流国外PHP框架(不包括国内框架)，大致对这些框架有个直观上的感受，简单分享一下，对于哪些做框架选型的时候，权当一个参考。

主要参考的框架包括：CodeIgniter、CakePHP、ZendFramework、Symfony

说明：我对很多框架也没有认真使用，只是简单试用了一下，可能很多看法不成熟或者是错误的，请大家指正，一起成长。

【 CodeIgniter 】

官方网站：http://codeigniter.com

中文网站：http://codeigniter.org.cn

中文手册：http://codeigniter.org.cn/user_guide

视频教程：http://codeigniter.org.cn/tutorials

测试版本：CodeIgniter_1.6.1

优点：

1. 配置简单，全部的配置使用PHP脚本来配置，执行效率高;具有基本的路由功能，能够进行一定程度的路由;具有初步的Layout功能，能够制作一定程度的界面外观;数据库层封装的不错，具有基本的MVC功能

2. 快速简洁，代码不多，执行性能高，框架简单，容易上手，学习成本低，文档详细;自带了很多简单好用的library，框架适合小型应用

缺点：

1. 把Model层简单的理解为数据库操作

2. 框架略显简单，只能够满足小型应用，略微不太能够满足中型应用需要

评价：

总体来说，拿CodeIgniter来完成简单快速的应用还是值得，同时能够构造一定程度的layout，便于模板的复用，数据操作层来说封装的不错，并且CodeIgniter没有使用很多太复杂的设计模式，执行性能和代码可读性上都不错。至于附加的 library 也还不错，简洁高效。

【 CakePHP 】

官方网站：http://www.cakephp.org

中文手册：http://www.1x3x.net/cakephp

视频教程：http://search.you.video.sina.com.cn/s?key=cakephp

测试版本：cake_1.1.19.6305

优点：

1. CakePHP是最类似于RoR的框架，包括设计方式，数据库操作的Active Record方式;设计层面很优雅，没有自带多余的 library，所有的功能都是纯粹的框架，执行效率还不错;数据库层的 hasOne, hasMany 功能很强大，对于复杂业务处理比较合适;路由功能，配置功能还不错;自动构建脚手架(scaffold)很强大;适合中型应用;基本实现过了MVC每一层;具有自动操作命令行脚本功能;

2. 文档比较全，在国内推广的比较成功，大部分都知道CakePHP，学习成本中等

缺点：

1. CakePHP非常严重的问题是把Model理解为数据库层操作，严重影响了除了数据库之外的操作能力

2. CakePHP的cache功能略显薄弱，配置功能稍嫌弱;CakePHP不适合大型应用，只适合中型应用，小型应用来说略微的学习成本高了点

评价：

总体来说CakePHP框架代表了PHP框架很重要的一个时代和代表，并且目前发挥着很重要的作用，不少自己写的框架都模仿了CakePHP的方式，是个里程碑式的产品;CakePHP透露着RoR的敏捷开发方式和把数据库操作认为是唯一Model的设计思想，作为开发快速应用和原型是绝好的工具;同样，用来做Web2.0网站的开发框架，也是值得选择的。

【 Zend Framework 】

官方网站：http://framework.zend.com

中文手册：http://www.phpeye.com/zf

视频教程：http://framework.zend.com/docs/screencasts

测试版本：ZendFramework-1.5.0

优点：

1. 官方出品，自带了非常多的 library，框架本身使用了很多设计模式来编写，架构上很优雅，执行效率中等;MVC设计中，比较简洁，具有路由功能，配置文件比较强大(能够处理 XML和php INI)，各种 library 很强大，是所有PHP框架中各种功能最全面的，包括它不仅是一个框架，更是一个大类库(取代PEAR)，这是它的主要特色;能够直观的支持除数据库操作之外的Model层(比 CodeIgniter 和 CakePHP 强)，并且能够很轻易的使用Loader功能加载其他新增加的Class;Cache功能很强大，从前端Cache到后端Cache都支持，后端 Cache支持Memcache、APC、SQLite、文件等等方式;数据库操作功能很强大，支持各种驱动(适配器)

2. 文档很全，在国内社区很成熟，并且目前不少Web 2.0网站在使用，学习成本中等

缺点：

1. MVC功能完成比较弱，View层简单实现(跟没实现一样)，无法很强大的控制前端页面

2. 没有自动化脚本，创建一个应用，包括入口文件，全部必须自己手工构建，入门成本高

3. Zend Framework 作为一个中型应用框架问题不大，也能够勉强作为大型应用的框架，但是作为一个很成熟的大型PHP框架来说，还需要一些努力

评价：

作为官方出品的框架，Zend Framework的野心是可以预见的，想把其他框架挤走，同时封装很多强大的类库，能够提供一站式的框架服务，并且他们的开发团队很强大，完全足够有能力开发很强大的产品出来，所以基本可以确定的是Zend Framework前途无量，如果花费更多的时间去完善框架。同样的，Zend Framework架构本身也是比较优雅的，说明Zend官方是有很多高手的，设计理念上比较先进，虽然有一些功能实现的不够完善，比如View层，自动化脚本等等，这些都有赖于未来的升级。总体来说Zend Framework是最值得期待的框架，当然，你目前要投入你的项目中使用也是完全没问题的。

【 Symfony 】

官方网站：http://www.symfony-project.org

中文网站：http://symfony-project.cn

权威指南：http://www.symfony-project.org/book

学习参考：http://sf.thecodecentral.com

测试版本：symfony-1.0.13

优点：

1. Symfony 是我了解的PHP框架中功能最强大的，而且我使用时间比较长，但是很多功能还是没有挖掘出来;它完整实现了MVC三层，封装了所有东西，包括 $_POST，$_GET 数据，异常处理，调试功能，数据检测;包含强大的缓存功能，自动加载Class(这个功能很爽)，强大的i18n国家化支持;具有很强大的view层操作，能够零碎的包含单个多个文件;非常强大的配置功能，使用yml配置能够控制所有框架和程序运行行为，强大到让人无语;能够很随意的定义各种自己的 class，并且symfony能够自动加载(auto load)这些class，能够在程序中随意调用;包含强大的多层级项目和应用管理：Project –> Application –> Module –> Action，能够满足一个项目下多个应用的需要，并且每层可以定义自己的类库，配置文件，layout;非常强大的命令行操作功能，包括建立项目、建立应用、建立模块、刷新缓存等等;

2. Symfony绝对是开发大型复杂项目的首选，因为使用了Symfony，将大大节约开发成本，并且多人协作的时候，不会出现问题，在Project级别定义好基础Class以后，任何模块都能够重用，大大复用代码

缺点：

1. 数据库操作model采用了重量级的propel和creole，不过在我测试的版本中已经把他们移到了addon里，可用可不用

2. 缓存功能无法控制，每次开发调试总是缓存，需要执行 symfony cc, symfony rc 来清除和重建缓存;

3. 效率不是很高，特别是解析模板和读取配置文件的过程，花费时间不少;

4. 学习成本很高，并且国内没有成熟的社区和文档，连中文手册都没有，相应的要掌握所有功能，需要花费比较多的时间

评价：

Symfony绝对是企业级的框架，唯一能够貌似能够跟Java领域哪些强悍框架抗衡的东西;强悍的东西，自然学习复杂，但是相应的对项目开发也比较有帮助，自然是推荐复杂的项目使用Symfony来处理，觉得是值得，后期的维护成本比较低，复用性很强。相应的如果使用Symfony的应该都是比较复杂的互联网项目，那么相应的就要考虑关于数据库分布的问题，那么就需要抛弃Symfony自带的数据库操作层，需要自己定义，当然了，Symfony支持随意的构造model层。

【总评】

以上数款框架，各有特色，而且都是开源项目，不过框架针对的项目不一样，一般来说 CodeIngiter 比较适合小型项目，CakePHP 和 Zend Framework 比较适合中型项目，Symfony 比较适合大型重量级项目，在项目选型的时候，要充分考虑框架的可以定制性、扩展性，因为每个项目都无法确定你是否会随着需求的变化进行改变。

相对来说，Zend Framework 和 Symfony 应对变化的能力比较强，特别是能够随意定制 model 层的Class，能够非常方便增加自己业务或者数据处理类，我是个人比较推荐在中大型项目中使用的框架。CodeIngiter 和 CakePHP 在中小型项目中同样能够发挥重大作用，快速开发和原型构建，非常适合目标不清晰的原型项目的开发。了解一个框架最好的方式就是使用它，学习它最好的方式就是看视频。:-)

仁者见仁，智者见智，在项目挑选框架的时候，请先认真考察项目的需求和未来的变化，然后选择合适的框架，让项目开发速度和后期维护性得到一个合理的平衡，当然了，也许，自己写一个框架更适合。

泛泛的评价了几款框架，估计很多东西都没有说到点子上，大家就姑且看之，同样欢迎提出看法指正!

1 comment »

Posted in programming, 分享

Tags: cakephp codeigniter symfony zendframework

The Big PHP IDE Test: Why Use One And Which To Choose

December 30th, 2009

在这篇文章中，作者比较了主流了PHP IDE，包括
* PDT 1
* PDT 2.0
* Zend Studio 6
* NetBeans 6.5
* NetBeans 7 (development version)
* Aptana PHP
* Aptana Studio Pro
* Codelobster *
* Nusphere PhpED 5.6 *

The full table at Google Docs (not editable snapshot)

Ides Best in The Big PHP IDE Test: Why Use One And Which To Choose

来源：http://www.smashingmagazine.com/2009/02/11/the-big-php-ides-test-why-use-oneand-which-to-choose/

No comments »

Posted in php, programming, 分享

Tags: aptana eclipse netbean zend studio

how they look at each other

December 28th, 2009

No comments »

Posted in funny, linux, programming, 分享

Timeline: 40 years of Unix

December 23rd, 2009

Year-by-year details of Unix’ history

http://www.computerworld.com/s/article/9133628/Timeline_40_years_of_Unix?taxonomyId=89&pageNumber=1

Computerworld – Ever wonder about how Unix got started, not to mention all the twists and turns it took along the way? Here are some milestones of the operating system’s four-decade-long history.

1956

A U.S. Department of Justice consent decree enjoins AT&T from “engaging … in any business other than the furnishing of common carrier communication services.”

1969

Mar. — AT&T-owned Bell Laboratories withdraws from development of Multics (Multiplexed Information and Computing Service), a pioneering but overly complicated time-sharing system. Some important principles in Multics will be carried over into Unix.

Unix got its start on the PDP-7 minicomputer.
Credit: Toresbe (cc-by-sa 1.0)

Aug. — Ken Thompson at Bell Labs writes the first version of an as-yet-unnamed operating system, in assembly language for a DEC PDP-7 minicomputer.

1970

Thompson’s operating system is named Unics, for Uniplexed Information and Computing Service and a pun on “emasculated Multics.” (The name is later mysteriously changed to Unix.)

1971

Feb. — Unix moves to the new Digital Equipment Corp. PDP-11 minicomputer.

Nov. — The first edition of the “Unix Programmer’s Manual,” written by Ken Thompson and Dennis Ritchie, is published.

1972

Thompson and Ritchie in the early days of Unix.

Dennis Ritchie develops the C programming language.

1973

Unix matures. The “pipe,” a mechanism for sharing information between two programs, which will influence operating systems for decades, is added to Unix. Unix is rewritten from assembler into C.

1974

Jan. — The University of California at Berkeley receives a copy of Unix.

July — “The UNIX Timesharing System,” by Dennis Ritchie and Ken Thompson, appears in the monthly journal of the Association for Computing Machinery (ACM). The authors call it “a general-purpose, multi-user, interactive operating system.” The article produces the first big demand for Unix.

1976

Bell Labs programmer Mike Lesk develops UUCP (Unix-to-Unix Copy Program) for network transfer of files, e-mail and Usenet content.

1977

Unix is ported to non-DEC hardware: Interdata 8/32 and IBM 360.

1978

Bill Joy, a graduate student at Berkeley, sends out copies of the first Berkeley Software Distribution (1BSD), essentially Bell Labs’ Unix V6 with some add-ons. BSD becomes a rival Unix branch to AT&T’s Unix; its variants and eventual descendents include FreeBSD, NetBSD, OpenBSD, DEC Ultrix, SunOS, NeXTstep/OpenStep and Mac OS X.

1980

4BSD, with DARPA sponsorship, becomes the first version of Unix to incorporate TCP/IP.

Bill Joy launched the BSD branch of Unix and co-founded Sun.
Credit: SqueakBox (cc-by-sa 2.0)

1982

Bill Joy co-founds Sun Microsystems to produce the Unix-based Sun workstation.

1983

AT&T releases the first version of the influential Unix System V, which will become the basis for IBM’s AIX and Hewlett Packard’s HP-UX.

Ken Thompson and Dennis Ritchie receive the ACM’s Turing Award “for their development of generic operating systems theory and specifically for the implementation of the UNIX operating system.”

Richard Stallman announces plans for the GNU (GNU’s not Unix) operating system, a Unix look-alike composed of free software.

1984

At the Winter USENIX/UniForum meeting, AT&T describes its support policy for Unix: “No advertising, no support, no bug fixes, payment in advance.”

X/Open Co., a European consortium of computer makers, is formed to standardize Unix in the X/Open Portability Guide.

1985

AT&T publishes the System V Interface Definition (SVID), an attempt to set a standard for how Unix works.

1986

Rick Rashid and colleagues at Carnegie Mellon University create the first version of Mach, a replacement kernel for BSD Unix intended to create an operating system with good portability, strong security and use in multiprocessor applications.

1987

Andrew Tanenbaum wrote Minix, a Unix clone for academic use.
Credit: GerardM (GNU FDL)

AT&T Bell Labs and Sun Microsystems announce plans to co-develop a system that would unify the two major Unix branches.

Andrew Tanenbaum writes Minix, an open-source Unix clone for use in computer science classrooms.

1988

The “Unix Wars” are underway. In response to the AT&T/Sun partnership, rival Unix vendors including DEC, HP and IBM form the Open Software Foundation (OSF) to develop open Unix standards. AT&T and its partners then form their own standards group, Unix International.

The IEEE publishes Posix (Portable Operating System Interface for Unix), a set of standards for Unix interfaces.

1989

Unix System Labs, an AT&T Bell Labs subsidiary, releases System V Release 4 (SVR4), its collaboration with Sun that unifies System V, BSD, SunOS and Xenix.

1990

The OSF releases its SVR4 competitor, OSF/1, which is based on Mach and BSD.

1991

Sun Microsystems announces Solaris, an operating system based on SVR4.

Linux Torvalds writes Linux, an open-source OS kernel inspired by Minix.

Linus Torvalds wrote Linux, an open-source Unix look-alike.

1992

The Linux kernel is combined with GNU to create the free GNU/Linux operating system, which many refer to as simply “Linux.”

1993

AT&T sells its subsidiary Unix System Laboratories and all Unix rights to Novell. Later that year Novell transfers the Unix trademark to the X/Open group.

Microsoft introduces Windows NT, a powerful 32-bit multiprocessor operating system. Fear of NT will spur true Unix standardization efforts.

1994

NASA invents Beowulf computing based on inexpensive clusters of commodity PCs running Unix or Linux on a TCP/IP LAN.

1996

X/Open merges with Open Software Foundation to form The Open Group.

Ken Thompson, Dennis Ritchie, Bill Clinton

Thompson and Ritchie receive the National Medal of Technology from President Clinton.

1999

U.S. President Clinton presents the National Medal of Technology to Ken Thompson and Dennis Ritchie for their work at Bell Labs.

2001

Apple releases Mac OS X, a desktop operating system based on the Mach kernel and BSD.

2002

The Open Group announces Version 3 of the Single UNIX Specification (formerly Spec 1170).

Sources: Peter H. Salus, A Quarter Century of Unix; Microsoft; AT&T; The Open Group, Wikipedia and other sources.

No comments »

Posted in programming, unix, 分享

Tags: unix

php security measures against csrf attacks

December 19th, 2009

CSRF stand for Cross Site Request Forgeries, it’s a method that allows an outside attacker to send malformed HTTP requests to a website, but from a victim’s computer. In this case the actual victim is the accomplice to this attack.

Stronger security measures must be implemented in order to avoid CSRF attacks, and to make sure the website and it’s users are not vulnerable.

To better understand CSRF attacks let’s look at an example. Let’s say you’re signed in to Facebook, you browse around and in the mean time you open a new window or a new tab and visit another site. It’s a typical scenario. Now, your still signed in at Facebook on the other tab and you visit a site where there’s a CSRF attack implemented. Now the CSRF site actually could send out spam to your Facebook friends or even delete your account, all this using your credentials, because a session is saved when you logged into Facebook (remember, on the other tab).

CSRF Attack Example:

<form action="process.php" method="get">
   <input type="text" name="amount" value="33" />
   <input type="text" name="destination_card_number" value="1111222233334444" />
   <input type="submit" name="submit" value="Transfer" />
</form>

Consider the above fictive card payment transfer form. The request method GET is used to simplify the example, but CSRF is not immune against POST requests either.

The actual request would look something like this if it’s posted let’s say to example.com:

   http://www.example.com/process.php?amount=33&destination_card_number=1111222233334444

The only thing an attacker has to do is include a request on the “attack web page” (e.g. csrfhacker.com, this is just a fictive site), when you visit this site, the request will be sent to example.com and a transfer would be made with your credentials.

The most common form to fire requests from an attack website is to use the img HTML tag, because before the browser shows you the image, it actually sends a request to the server for that image resource. Now if the attacker includes this on his attack web page:

<img src="http://www.example.com/process.php?amount=33&destination_card_number=1111222233334444" />

and a user visits this website the request will be sent to example.com and the transfer will be made. What’s worst that this attack is completely transparent for users, all they would see is a broken image on the website.

As a user you can’t do anything against CSRF attacks, as a webmaster you can. Although a webmaster cannot control his website’s visitors, but fortunately he can filter out CSRF attacks just as easily as the attack could be implemented.

Let’s see the security measures a web developer should take in order to successfully knock out CSRF attacks:

1. Protection Against XSS Attacks

You should make sure your website is protected against XSS (cross site scripting) attacks, if not then it’s useless to protect against CSRF, because with any security measure an attacker could bypass this with a counter XSS attack.

Also using POST requests doesn’t eliminate CSRF attacks, it makes a little harder for the attacker, and this is the point.

2. Using a Form Token

The root problem with CSRF vulnerability is the failure to verify the source request. A good web developer should already know that by simply relying on $_SERVER['REMOTE_ADDR'] is not effective, almost useless. With the help of a form token we could verify the request’s source.

A token could be a simple random number that can be injected in the target form as a hidden input element, and also saved in the session when the form is rendered. When the form is submitted the token from the request can be compared to the token that is saved in the session. If the two doesn’t match the form should be discarded.

Generating a form token in PHP is easy:

1	$token = md5(uniqid(rand(), true));

Implementing the token is also easy, just save it in user’s session and inject it in the target form:

1	$_SESSION['token'] = $token;

<form action="process.php" method="post">
   <input type="hidden" name="token" value="<?php echo $token; ?>">
   <input type="text" name="amount" />
   <input type="text" name="destination_card_number" />
   <input type="submit" name="submit" value="Transfer" />
</form>

When the request was sent the token should be compared like this:

 
if ( (!empty($_SESSION['token'])) && (!empty($_POST['token'])) ) {
	if ($_SESSION['token'] == $_POST['token']) {
	   //process the form
	}
}

Keep in mind to filter and validate any form request.

3. Using Form Timeout

Using form timeout adds extra security to the form and to the web application itself, which is always a good thing to do.

Form timeout consists of saving the time when the form is rendered and compare it to the time when the form request was sent to the server. From this time-frame we could filter out potential attacks, not just CSRF, but also spam bots too.

Setting a maximum time-frame in which the form must be submitted is recommended, but don’t forget to also set a minimum time-frame in which if the form is submitted would be discarded, because we’re dealing with either spam bots or an automated CSRF attack. It is unrealistic that a human can submit a form with 4 – 5 fields under 2 seconds.

To implement this security measure the following code or similar is required:

1	$_SESSION['time'] = time();

When the request was made the comparison should look like this:

$min_allowed_time = 20;
$max_allowed_time = 60;
 
if  ( (time() - $_SESSION['time']) < $min_allowed_time ) {
   echo 'form discarded';
}
 
if  ( (time() - $_SESSION['time']) > $max_allowed_time ) {
   echo 'form timeout';
}

http://www.serversidemagazine.com/php/php-security-measures-against-csrf-attacks

No comments »

Posted in php, programming, 分享

Tags: csrf

how to create and apply a patch with subversion

December 19th, 2009

you know how often you need to create a patch when you’re a creative open source guy

here is the resoure: http://ariejan.net/2007/07/03/how-to-create-and-apply-a-patch-with-subversion/

1. create patch file using svn diff


svn diff > ~/fix_ugly_bug.diff

2. using the patch file to patch

patch -p0 -i ~/fix_ugly_bug.diff