SlideShare una empresa de Scribd logo
1 de 35
Descargar para leer sin conexión
Hidden in plain site
Joomla! hidden secrets for code monkeys
Junior Dev Stuff
Input
$app = JFactory::getApplication();

$option = $app->input
->getCmd(‘option’);
File uploads
with security check
$app = JFactory::getApplication();

$option = $app->input->files

->get('file', array());
File uploads
without security check
$app = JFactory::getApplication();

$option = $app->input->files

->get('file', array(), 'raw');
Date and Time
$dateString = '2015-05-31 12:00:00';

$date = JFactory::getDate($dateString);

$format = JText::_('DATE_FORMAT_LC2');

echo $date->format($format);
URI manipulation
$uri = JUri::getInstance();

$uri->setVar('joomla', 'rocks');

echo $uri->toString();
Serious low-level stuff
$http = JHttpFactory::getHttp();

$response = $http->get('http://www.joomla.org/
download.html');



$this->out("HTTP Code: " . $response->code);

$this->out("Headers:n" . print_r($response-
>headers, true));
HTTP Transfers

without the pain of cURL and stream contexts
$stream = new JStream();



$stream->open(JPATH_SITE . '/tmp/temp.gz', 'w',
false, null, false, false, true);

$stream->write($buffer);

$stream->chmod();

$stream->close();
Stream file I/O

with transparent GZip / BZip2 support
JArchive::extract($archiveName, $targetFolder);
Extract archives

zip, tar, tar.gz / tgz, tar.bz2 / tbz
JStringPunycode::emailToPunycode('üser@êxαmpłe.com'
);

// üser@xn--xmpe-fpa54cg0l.com



JStringPunycode::urlToPunycode('http://
www.παράδειγμα.com');

// http://www.xn--hxajbheg2az3al.com



JStringPunycode::fromPunycode('http://www.xn--
hxajbheg2az3al.com');

// http://www.παράδειγμα.com
UTF-8 Domains

a.k.a. “Punycode” or IDNA conversion
$image = new JImage(__DIR__ . '/image.jpg');

$image->createThumbs([
'640x480', '320x200', '160x100', ‘80x50'
], JImage::SCALE_FILL, __DIR__ . '/thumbs');
Image manipulation

Thumbnails
$image = new JImage(__DIR__ . '/image.jpg');

$newImage = $image

->filter('grayscale')

->rotate('10', 0xFFFFFF, true)

->resize(320, 200);

$newImage->toFile(
__DIR__ . ‘/altered.png',
IMAGETYPE_PNG
);
Image manipulation

Alter and convert images
Files and databases
GitHub integration

JGithub
$patcher = JFilesystemPatcher::getInstance();

$patcher

->reset()

->addFile(
__DIR__ . ‘/file1.patch',
JPATH_BASE, 1
);

$patcher->apply();
Apply patch files

JFilesystemPatcher
$schemaUpdater = JSchemaChangeset::getInstance(
$db, '/path/to/sql/files'
);

$errors = $schemaUpdater->check();

$schemaUpdater->fix();
Update the schema

or get a list of errors (changes not applied)
$config = [

'dbinstaller_directory' => '/path/to/xml/files',

'option' => 'com_example'

];

$schemaUpdater = new FOFDatabaseInstaller($config);

// Install or update schema

$schemaUpdater->updateSchema();

// Remove the schema

$schemaUpdater->removeSchema();
XML-based schema updates

using FOFDatabaseInstaller
$db = JFactory::getDbo();

$exporter = $db->getExporter();

$xml = $exporter->asXml();
Exporting the database

Here Be Dragons!
$db = JFactory::getDbo();

$importer = $db->getImporter();

$importer->from($xml);



// Bug: mergeStructure is protected. Sad panda :(

// $importer->mergeStructure();



$reflection = new ReflectionObject($importer);

$method = $reflection->getMethod('mergeStructure');

$method->setAccessible(true);

$method->invoke($importer);
Importing the database

Here Be Dragons!
Dial the awesome to
eleven!
Services
Lots of!
JFacebook JLinkedin
JGoogle JTwitter
JMediawiki JOpenstreetmapJOauth1Client
JOauth2Client
Services
Lots of!
Cryptography

JKeychain & JCrypt
• 3DES
• Blowfish
• Rijndael256 (AES)
• Simple (don’t use)
• mcrypt
// Set up

$plugin = JFactory::getApplication()->getParams()
->get('captcha',

JFactory::getConfig()->get('captcha'));

$captcha = JCaptcha::getInstance($plugin, array(

'namespace' => 'myComponent'

));



// Show

echo $captcha->display('mycaptcha', 'mycaptcha');



// Validate

$code = JFactory::getApplication()->input->get('mycaptcha');

if (!$captcha->checkAnswer($code))

{

throw new RuntimeException('Bots not welcome', 403);

}
CAPTCHA

Keep bots away
$less = new JLess();

$less->ccompile($lessFile, $cssFile);
Compile LESS to CSS

Server-side, cached
$pathway = JFactory::getApplication()
->getPathway();

$pathway->addItem('MyItem', $url);
Manipulate breadcrumbs

Custom, in-component pathways
Microdata

Schema.org support
https://docs.joomla.org/Microdata
More than a CMS

Custom application types
• JApplicationCLI
• JApplicationWeb
• JApplicationDaemon
Photos by Smithsonian Institution, National Museum of American History
May the
Core
be with you
The End

Más contenido relacionado

La actualidad más candente

20 modules i haven't yet talked about
20 modules i haven't yet talked about20 modules i haven't yet talked about
20 modules i haven't yet talked about
Tatsuhiko Miyagawa
 
jQuery: out with the old, in with the new
jQuery: out with the old, in with the newjQuery: out with the old, in with the new
jQuery: out with the old, in with the new
Remy Sharp
 
News of the Symfony2 World
News of the Symfony2 WorldNews of the Symfony2 World
News of the Symfony2 World
Fabien Potencier
 
Unit and Functional Testing with Symfony2
Unit and Functional Testing with Symfony2Unit and Functional Testing with Symfony2
Unit and Functional Testing with Symfony2
Fabien Potencier
 

La actualidad más candente (20)

The Origin of Lithium
The Origin of LithiumThe Origin of Lithium
The Origin of Lithium
 
New in cakephp3
New in cakephp3New in cakephp3
New in cakephp3
 
20 modules i haven't yet talked about
20 modules i haven't yet talked about20 modules i haven't yet talked about
20 modules i haven't yet talked about
 
jQuery: out with the old, in with the new
jQuery: out with the old, in with the newjQuery: out with the old, in with the new
jQuery: out with the old, in with the new
 
Php 101: PDO
Php 101: PDOPhp 101: PDO
Php 101: PDO
 
Future of HTTP in CakePHP
Future of HTTP in CakePHPFuture of HTTP in CakePHP
Future of HTTP in CakePHP
 
Building Lithium Apps
Building Lithium AppsBuilding Lithium Apps
Building Lithium Apps
 
Advanced Querying with CakePHP 3
Advanced Querying with CakePHP 3Advanced Querying with CakePHP 3
Advanced Querying with CakePHP 3
 
News of the Symfony2 World
News of the Symfony2 WorldNews of the Symfony2 World
News of the Symfony2 World
 
Doctrine MongoDB ODM (PDXPHP)
Doctrine MongoDB ODM (PDXPHP)Doctrine MongoDB ODM (PDXPHP)
Doctrine MongoDB ODM (PDXPHP)
 
Zero to SOLID
Zero to SOLIDZero to SOLID
Zero to SOLID
 
Lithium Best
Lithium Best Lithium Best
Lithium Best
 
Perl5i
Perl5iPerl5i
Perl5i
 
Introduction to the Pods JSON API
Introduction to the Pods JSON APIIntroduction to the Pods JSON API
Introduction to the Pods JSON API
 
Agile database access with CakePHP 3
Agile database access with CakePHP 3Agile database access with CakePHP 3
Agile database access with CakePHP 3
 
Symfony2 - WebExpo 2010
Symfony2 - WebExpo 2010Symfony2 - WebExpo 2010
Symfony2 - WebExpo 2010
 
Unit and Functional Testing with Symfony2
Unit and Functional Testing with Symfony2Unit and Functional Testing with Symfony2
Unit and Functional Testing with Symfony2
 
Pemrograman Web 8 - MySQL
Pemrograman Web 8 - MySQLPemrograman Web 8 - MySQL
Pemrograman Web 8 - MySQL
 
Undercover Pods / WP Functions
Undercover Pods / WP FunctionsUndercover Pods / WP Functions
Undercover Pods / WP Functions
 
Алексей Плеханов: Новинки Laravel 5
Алексей Плеханов: Новинки Laravel 5Алексей Плеханов: Новинки Laravel 5
Алексей Плеханов: Новинки Laravel 5
 

Similar a Hidden in plain site – joomla! hidden secrets for code monkeys

Keeping it Small: Getting to know the Slim Micro Framework
Keeping it Small: Getting to know the Slim Micro FrameworkKeeping it Small: Getting to know the Slim Micro Framework
Keeping it Small: Getting to know the Slim Micro Framework
Jeremy Kendall
 
Phpne august-2012-symfony-components-friends
Phpne august-2012-symfony-components-friendsPhpne august-2012-symfony-components-friends
Phpne august-2012-symfony-components-friends
Michael Peacock
 
vfsStream - effective filesystem mocking
vfsStream - effective filesystem mocking vfsStream - effective filesystem mocking
vfsStream - effective filesystem mocking
Sebastian Marek
 

Similar a Hidden in plain site – joomla! hidden secrets for code monkeys (20)

Min-Maxing Software Costs
Min-Maxing Software CostsMin-Maxing Software Costs
Min-Maxing Software Costs
 
How Kris Writes Symfony Apps
How Kris Writes Symfony AppsHow Kris Writes Symfony Apps
How Kris Writes Symfony Apps
 
Adding Dependency Injection to Legacy Applications
Adding Dependency Injection to Legacy ApplicationsAdding Dependency Injection to Legacy Applications
Adding Dependency Injection to Legacy Applications
 
Symfony components in the wild, PHPNW12
Symfony components in the wild, PHPNW12Symfony components in the wild, PHPNW12
Symfony components in the wild, PHPNW12
 
Api Design
Api DesignApi Design
Api Design
 
Unittests für Dummies
Unittests für DummiesUnittests für Dummies
Unittests für Dummies
 
Dpilot Source Code With ScreenShots
Dpilot Source Code With ScreenShots Dpilot Source Code With ScreenShots
Dpilot Source Code With ScreenShots
 
Dpilot - Source Code with Snapshots
Dpilot - Source Code with SnapshotsDpilot - Source Code with Snapshots
Dpilot - Source Code with Snapshots
 
Source Code for Dpilot
Source Code for Dpilot Source Code for Dpilot
Source Code for Dpilot
 
Keeping it Small: Getting to know the Slim Micro Framework
Keeping it Small: Getting to know the Slim Micro FrameworkKeeping it Small: Getting to know the Slim Micro Framework
Keeping it Small: Getting to know the Slim Micro Framework
 
Symfony without the framework
Symfony without the frameworkSymfony without the framework
Symfony without the framework
 
Advanced symfony Techniques
Advanced symfony TechniquesAdvanced symfony Techniques
Advanced symfony Techniques
 
jQuery secrets
jQuery secretsjQuery secrets
jQuery secrets
 
PHPUnit elevato alla Symfony2
PHPUnit elevato alla Symfony2PHPUnit elevato alla Symfony2
PHPUnit elevato alla Symfony2
 
Forget about Index.php and build you applications around HTTP - PHPers Cracow
Forget about Index.php and build you applications around HTTP - PHPers CracowForget about Index.php and build you applications around HTTP - PHPers Cracow
Forget about Index.php and build you applications around HTTP - PHPers Cracow
 
Virtual Madness @ Etsy
Virtual Madness @ EtsyVirtual Madness @ Etsy
Virtual Madness @ Etsy
 
Phpne august-2012-symfony-components-friends
Phpne august-2012-symfony-components-friendsPhpne august-2012-symfony-components-friends
Phpne august-2012-symfony-components-friends
 
vfsStream - effective filesystem mocking
vfsStream - effective filesystem mocking vfsStream - effective filesystem mocking
vfsStream - effective filesystem mocking
 
WordPress overloading Gravityforms using hooks, filters and extending classes
WordPress overloading Gravityforms using hooks, filters and extending classes WordPress overloading Gravityforms using hooks, filters and extending classes
WordPress overloading Gravityforms using hooks, filters and extending classes
 
14. CodeIgniter adaugarea inregistrarilor
14. CodeIgniter adaugarea inregistrarilor14. CodeIgniter adaugarea inregistrarilor
14. CodeIgniter adaugarea inregistrarilor
 

Más de Nicholas Dionysopoulos

Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...
Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...
Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...
Nicholas Dionysopoulos
 
Joomla! Day Poland 2012 - Monetize your site with Akeeba Subscriptions
Joomla! Day Poland 2012 - Monetize your site with Akeeba SubscriptionsJoomla! Day Poland 2012 - Monetize your site with Akeeba Subscriptions
Joomla! Day Poland 2012 - Monetize your site with Akeeba Subscriptions
Nicholas Dionysopoulos
 
Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...
Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...
Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...
Nicholas Dionysopoulos
 
Joomla! Day Poland 2012 - Active Security for Joomla! sites
Joomla! Day Poland 2012 - Active Security for Joomla! sitesJoomla! Day Poland 2012 - Active Security for Joomla! sites
Joomla! Day Poland 2012 - Active Security for Joomla! sites
Nicholas Dionysopoulos
 

Más de Nicholas Dionysopoulos (11)

Rapid application development with FOF
Rapid application development with FOFRapid application development with FOF
Rapid application development with FOF
 
Joomla! Security 101 - Joomla! Day Bosnia and Herzegovina 2013
Joomla! Security 101 - Joomla! Day Bosnia and Herzegovina 2013Joomla! Security 101 - Joomla! Day Bosnia and Herzegovina 2013
Joomla! Security 101 - Joomla! Day Bosnia and Herzegovina 2013
 
Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...
Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...
Joomla! Frappe - Κατασκευή εφαρμογών για το Joomla! χωρίς να τραβάτε τα μαλιά...
 
JWC - Rapid application development with FOF
JWC - Rapid application development with FOFJWC - Rapid application development with FOF
JWC - Rapid application development with FOF
 
FOF Rapid Application Development on Joomla! - Joomla! Day Denmark 2012
FOF Rapid Application Development on Joomla! - Joomla! Day Denmark 2012FOF Rapid Application Development on Joomla! - Joomla! Day Denmark 2012
FOF Rapid Application Development on Joomla! - Joomla! Day Denmark 2012
 
Advanced Akeeba Backup (Joomla! Day Denmark 2012)
Advanced Akeeba Backup (Joomla! Day Denmark 2012)Advanced Akeeba Backup (Joomla! Day Denmark 2012)
Advanced Akeeba Backup (Joomla! Day Denmark 2012)
 
Joomla! Day Deutschland 2012 - Advanced Akeeba Backup
Joomla! Day Deutschland 2012 - Advanced Akeeba BackupJoomla! Day Deutschland 2012 - Advanced Akeeba Backup
Joomla! Day Deutschland 2012 - Advanced Akeeba Backup
 
Joomla! Day Deutschland 2012 - Active Security
Joomla! Day Deutschland 2012 - Active SecurityJoomla! Day Deutschland 2012 - Active Security
Joomla! Day Deutschland 2012 - Active Security
 
Joomla! Day Poland 2012 - Monetize your site with Akeeba Subscriptions
Joomla! Day Poland 2012 - Monetize your site with Akeeba SubscriptionsJoomla! Day Poland 2012 - Monetize your site with Akeeba Subscriptions
Joomla! Day Poland 2012 - Monetize your site with Akeeba Subscriptions
 
Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...
Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...
Joomla! Day Poland 2012 - Advanced Akeeba Backup - Beyond just backing up you...
 
Joomla! Day Poland 2012 - Active Security for Joomla! sites
Joomla! Day Poland 2012 - Active Security for Joomla! sitesJoomla! Day Poland 2012 - Active Security for Joomla! sites
Joomla! Day Poland 2012 - Active Security for Joomla! sites
 

Último

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
panagenda
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
Joaquim Jorge
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 

Último (20)

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024Top 10 Most Downloaded Games on Play Store in 2024
Top 10 Most Downloaded Games on Play Store in 2024
 

Hidden in plain site – joomla! hidden secrets for code monkeys