How-to

Articles On Single HOW-TO Tutorial

The Secret Arguments Array in JavaScript

Well, this is not really a secret to be exact. Many experience programmers who have worked with JavaScript for many years will surely come across arguments array. Some book may even forgotten the existence of arguments array since it is not widely used. Hence, i believe majority of JavaScript programmers do not actually know the existence of such array in JavaScript. So allow me to explain what is arguments array.

Arguments Array

An arguments array is a predefined array used within a function in JavaScript. Whether you used it or not it will still exist within that function. The main advantage of using arguments array is the unlimited number of argument or parameter you can pass into a function. Let's consider the following example,

function example()
{
	var sum = 0;
	for(i = 0; i < arguments.length;i++)
	{
		sum += arguments[i];
	}
	alert(sum); //45
}
example(1,2,3,4,5,6,7,8,9,0);

i find that the above example will simply get the idea through how arguments array worked. It is an array so whatever we passed in via arguments will be placed into an arguments array within the function. Then, we simple just used it. The above example is an simple addition function. You can see another example at override ‘this’ object in JavaScript

Detect Arguments

What if we want to use the arguments array in certain circumstances but not all the times? Preload with jQuery shows one particular function that uses an array or parameter depend on how users want to use that function (now, you might have guess how a library such as jQuery allows multiple different parameter for a single function). In order to do that, we have to detect what arguments or values been passed on to the function.

In JavaScript, we can detect a particular value by using comparison operators (===, ==, !=, etc.) but there are also other techniques to detect these arguments. We can use in operator which detect whether a given value is in the arguments array (in operator is not widely supported. Thus, you don't see many using it). There are also typeOf operator which determine what is the type of the value (string, object, int, etc.)which you can see from Preload with jQuery article. Lastly, there is Autocasting operator which evaluate whether a variable has a value (NaN, 0, false, undefined, null, or an empty string are considered as no value). Let's look at each new detection method example that i mention here.

//Detect whether there is a "hello" member in the arguments array: 
var parameter = 'hello' in arguments? arguments : "";

//Detect whether arguments contains at least one argument
var parameter = typeof arguments[0] != 'undefined'? arguments : "";

//Detect whether the user passed an object(can be array) or a list of arguments
var parameter = (typeof arguments[0] == 'object')? arguments[0] : arguments;

//Detect whether there is an arguments passed into the function and assign the number of arguments into the variable
var parameter = arguments.length || "";

Summary

Using Argument Array is great as we are not restricted by the number of parameter on a given function. However, many online tutorial on basic JavaScript no longer practice this since it is said that this has been depreciated with new browsers emerged but its still usable in JavaScript up till today (who said its depreciated!).

Tutorial: How to override ‘this’ object in JavaScript

Have you ever experience a time when the calling object 'this' needed to be override and somehow you just couldn't do that? You tried left hand assignment but it just won't work? wondering how can 'this' object be overridden in JavaScript but can't find the correct answer on Google? This article will explain how this can be done.

Left hand assignment

Ever tried left hand assignment to override 'this' object?

var obj = document.getElementById("button");
this = obj

It will fail and gives you 'invalid assignment left-hand side'.

Using Call() to override 'this' object

There is a function in JavaScript, Call() which can help you override 'this' object or specify the 'this' object. Let's consider the following example,

function example(a,b)
{
	this.value == 'button'?alert(a):alert(b);
}
var textobj = document.getElementById('input_relink');
example.call(textobj, 'It is a button!', 'It is not a button');

We look at a text box and check whether the user key in 'button'. But we uses 'this' object to verify the input text in the function example which takes in two parameter as shown above. The Call() method is used whenever you wish to override 'this' object which is placed at the first parameter and the rest of the parameter will be exactly the same as the method parameter. Hence, we used the function in this way for the above example because it has two parameter.

//override 'this' with object 'textobj'
example.call(textobj, 'It is a button!', 'It is not a button');

If we have another function which takes in 3 parameter, we will do this.

function example(a,b, c)
{
	this.value == 'button'?alert(a):alert(b);
	alert(c);
}
var textobj = document.getElementById('input_relink');
example.call(textobj, 'It is a button!', 'It is not a button', 'Completed');

You can also used it without parameter like the one illustrated below, 

var o = { x: 15 };
function f()
{
    alert(this.x);
}
f.call(o);

Using Call() method restrict your variable given on the method. On the other hand, we can use another method Apply() which override the 'this' object giving the second parameter as an array.

Using Apply() method to override 'this' object

The difference between call and apply method is the parameter needed to use them. For Call() method it depends on the parameter of the function as shown above. But for Apply() method it can have more than the amount of parameter in the function (since it takes in an array). Similarly, the first parameter of both methods are used to override 'this' object. Let's consider the following example,

var o = { x: 8 };
function example()
{          
    // arguments[0] == object 
	var sum = 0;
    for(var i = 1; i < arguments.length; i++)
    {
       sum+=arguments[i]
    }
	alert(sum+ this.x);
}
example.apply(o, 1, 2, 3, 4)

I am using the depreciated argument array to look through the argument being passed into the function, sum them up, alert to the user. Similarly, i can do this using an array.

var o = { x: 8 };
function example(a, b, c)
{          
	alert(this.x+a+b+c);
}
example.apply(o, [1,2,3])

Pretty simple isn't it?

Secure File Upload Check List With PHP

Uploading file on your website is a very common thing nowadays. Image, zip and many other common file type are the usual things we want our users to be able to upload. However, potential evil files such as .exe, .php and other script files are those that we wish they can never be able to upload on to our server. And i am sure you are like me who will wonder whether my upload handler is secure enough to prevent attacks from coming in. In this article, i will try to list down most of the secure ways to protect our server and business from these potential threat. On the other hand, feel free to share your experience with the readers and me on the security tips you have.

Content Type Verification

Checking the content-type of a file is the first level of verification that many of us will do.

<?php
#easiest way to verify it is a image file
if(!eregi('image/', $_FILES['hpt_files']['type'])) 
{
	echo 'Please upload a valid file!';
	exit(0);
}
?>

Although, this can be easily bypass by attacker by changing the Content-type header which we will look at later. Nonetheless, it is something we must always check. Please take note that different MIME type may differ in different web browsers.

Verify Image File Content

Uploading image file is something most application will allow. An attacker can change the content-type to a valid one in order for your script to accept the file. Thus, we will have to ensure that this is really an image file by using getimagesize() in PHP. 

<?php
$imageinfo = getimagesize($_FILES['uploadfile']['tmp_name']);
if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg' && isset($imageinfo)) 
{
	echo 'Sorry, we only accept GIF and JPEG images\n';
	exit(0);
}
?>

You might want to check on other information as well. However, a file can be a proper GIF or JPEG image and at the same time a valid PHP script. Most image formats allow a text comment. It is possible to create a perfectly valid image file that contains some PHP code in the comment. How? By taking an image file (.jpg) and upload as a php extension file(.php). When getimagesize() look at it, it is a valid image file but when the PHP interpreter looks at it, the PHP code in the comment will be executed and other binary code will be discarded as junk (similar to HTML + PHP + JavaScript). Thus, getimagesize() only provides certain level of verification while many more have to be there in order to fully protect yourself.

Verify File Extension

This is something every upload handler in PHP must do. An attacker can fake the content-type of a file to the server, the extension must be a valid extension for PHP machine to interpret it correctly. Although this is not all of the security measure, this is definitely one of the important verification. I have included both white and black list on the code (although only one of them is required usually) since we won't know what will happen to the server configuration especially in a shared hosting environment.

<?php
$filename = strtolower($_FILES['uploadfile']['name']);
$whitelist = array('jpg', 'png', 'gif', 'jpeg'); #example of white list
$backlist = array('php', 'php3', 'php4', 'phtml','exe'); #example of black list
if(!in_array(end(explode('.', $fileName)), $whitelist))
{
	echo 'Invalid file type';
	exit(0);
}
if(in_array(end(explode('.', $fileName)), $backlist))
{
	echo 'Invalid file type';
	exit(0);
}
?>

This way even if an attacker fake their way by changing the content-type, they will not be able to change the fact that the extension is required for the file to be interpreted by the machine. However, what file extensions will be passed on to the PHP interpreter will depend on the server configuration. A developer will have no knowledge or control over the web server configuration. Some web application may require that files with .gif or .jpg extension are interpreted by PHP. Thus, any comment in the image file will be interpreted by the PHP machine as a valid instruction to be executed.

Basically, we can't guarantee that knowing what file extension is being interpreted by PHP machine can help eliminate all attack and it does not change at some point in the future, when some other application is installed on the web server.

The Upload Folder

We want to prevent users from requesting uploaded files directly. This means that the best place to keep these uploaded files is somewhere outside of the web root (www, public_html, etc.) or creating a directory under the web root and blocking web access to it in the Apache configuration or in a .htaccess file. If the attackers is able to upload some harmful file into your system, this will prevent them from executing the files and enter arbitrary code into the system as they are unable to access the location. Consider the following example,

<?php
$upload_dir = '/var/domainame/uploads/'; # Outside of web root
$upload_file = $uploaddir . basename($_FILES['uploadfile']['name']);
if (move_uploaded_file($_FILES['uploadfile']['tmp_name'], $uploadfile)) 
{
	echo 'Upload Successfully.';
	exit(0);
} 
else 
{
	echo 'Upload Fail';
	exit(0);
}
?>

This is somehow good but now the web server will not be able to access the directory too! Therefore, we need to provide another file for web server to access and display the file if necessary.

<?php
$upload_dir = '/var/domainame/uploads/'; # Outside of web root
$name = $_GET['name'];
readfile($uploaddir.$name);
?>

Now, both users and system will be able to access the directory provided that they know the name of the file. However, the above suffer from directory traversal vulnerability where a malicious user can use this script to read any readable file on the system. Consider the following example,

http://www.example.com/readfile.php?name=../secret/passwd

This will most probably return the password stored in the server. Therefore, always remember to secure your POST and GET in your PHP script.

IIS PUT Function

If you are running PHP on Microsoft IIS, you will have to take particular care on your writable web directories. Unlike Apache, Microsoft IIS supports 'PUT' HTTP requests, which allows users to upload files directly, without using an upload PHP page. However, 'PUT' requests can only be used to upload a file to your web directory if the file system permissions allow IIS to write to the directory and if IIS permission allowed writing for that directory.

To prevent this, we have to ensure that IIS permissions do not allow writing although we will have to allow the directory to be writable in order to upload using PHP script. This will caused one of the condition to fail and 'PUT' request will not be enable by IIS which is used to bypass all the check you have done on PHP script by using 'PUT' request to upload into your directory.

The Include Function

In some script, we tend to use the receive value from users to determine which file to include into the PHP script. This is usually not a good idea as the attacker can execute certain file in your web server. Consider the following example,

<?php
# ... some code here
if(isset($_COOKIE['lang'])) 
	$lang = $_COOKIE['lang'];
elseif (isset($_GET['lang'])) 
	$lang = $_GET['lang'];
elseif (isset($_GET['lang'])) 
	$lang = $_GET['lang'];
else 
	$lang = 'english';

include('language/$lang.php');
# ... some more code here
?>

Assuming no filter is done on the data received, we determine the language and include the language file into the page which is a common piece of code for some of you. An attacker can take this flaws and enter a path on the URL to execute certain file in the system. Therefore, it is important to secure your upload function to prevent attacker from execute any file that are harmful to your system.(imagine they are able to upload certain shell or execution command and activate it via the URL)

Random File Name

We talk about how a file name should not be access directly by the users to prevent any form of attack. However, we can still access these file indirectly with the help of another script. But if the attacker do not know the name of the file that he have just uploaded, they might not be able to execute these arbitrary code into your web server. Thus, it is always good to randomly rename your file with md5 or other encryption algorithm. Consider the following example,

<?php
$filename = $_FILES[$uploadfile]['name'];
$save_path = '/var/domainame/uploads/'; # Outside of web root
$extension = end(explode('.', $filename)); #extension of the file
$renamed = md5($filename. time());		#rename of the file
if (!@move_uploaded_file($_FILES[$uploadfile]['tmp_name'], $save_path.$renamed. $extension)) 
{
	echo 'File could not be saved.';
	exit(0);
}
?>

However, if the uploading is done by yourself through an upload function, renaming these uploaded files might not be good for SEO purposes. Thus, the security measure here are for upload function that allows visitors or external users to upload certain file into your web server. ( basically you don't trust others than yourself )

Disable Script Execution

You can also try to disabled script execution on the uploaded folder where all the files go. You can do this by writing a .htacess file on the folder.

AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi
Options -ExecCGI

This will gives you an extra layer of protection. You can also restrict certain file to be placed into the folder and only allows certain file to be placed into the folder. But remember that if some web application allows your 'white list' extension file to be interpreted by php machine, the chances of this protection might not be very useful. Nonetheless, this still serve as one of the many layer of protection for your web serverr.

HTML Upload Size

Although not all browsers do not support this but some still does. This can help provides certain level of protection against upload restriction.

<!-- allow 100kb -->
<input type='hidden' name='MAX_FILE_SIZE' value='100000' />

PHP Upload Size

We must also restrict the upload size on PHP to prevent any harmful file that is large enough to caused a sever damage to our server (any attack can caused a huge damage anyway). Checking the file size can also help you minimize the amount of disk space needed for your server. 

<?php
#check for appropriate size with php.ini
$POST_MAX_SIZE = ini_get('post_max_size');
$mul = substr($POST_MAX_SIZE, -1);
$mul = ($mul == 'M' ? 1048576 : ($mul == 'K' ? 1024 : ($mul == 'G' ? 1073741824 : 1)));
if ($_SERVER['CONTENT_LENGTH'] > $mul*(int)$POST_MAX_SIZE && $POST_MAX_SIZE) $error = true; 
$max_file_size_in_bytes = 2147483647;				// 2GB in bytes
if(!$error)
{
	#restrict the limit
	$file_size = @filesize($_FILES[$upload_name]['tmp_name']);
	if (!$file_size || $file_size > $max_file_size_in_bytes) {
		HandleError('File exceeds the maximum allowed size');
		exit(0);
	}
}
else
{
	HandleError('File exceeds the maximum allowed size in php.ini');
	exit(0);
}
?>

You can visit the PHP handing file uploads for more information.

Limit File Upload

DOS attack (Denial of service) might be one of the concern that you have. Users might be able to upload a lot of large files and consume all available disk space which prevented other users from using the service. Hence, certain restriction should be imposed to prevent such cases from happening. The application designer might want to implement a limit on
the size and number of files one user can upload in a given period (a day)

BLOB Type Storage

An alternative to storing files on the file system is keeping file data directly in the database as a BLOB. This approach has the advantage that everything related to the application is stored either under the web root or in the database. However, this approach probably wouldn't be a good solution for large files or if the performance is critical.

Verify The Session

You may wish to impose certain security measure by having a session between the upload form and the upload handler to ensure that the user is authenticate to proceed with the upload.

Verify Upload

We must also verify that there is indeed a file being uploaded into the server to process the upload handler script.

<?php
if (!isset($_FILES[$upload_name])) {
	echo 'No upload found in \$_FILES for ' . $upload_name;
	exit(0);
} else if (isset($_FILES[$upload_name]['error']) && $_FILES[$upload_name]['error'] != 0) {
	echo $uploadErrors[$_FILES[$upload_name]['error']];
	exit(0);
} else if (!isset($_FILES[$upload_name]['tmp_name']) || !@is_uploaded_file($_FILES[$upload_name]['tmp_name'])) {
	echo 'Upload failed is_uploaded_file test.';
	exit(0);
} else if (!isset($_FILES[$upload_name]['name'])) {
	echo 'File has no name.';
	exit(0);
}
?>

The above is an example to verify whether there is an upload file and whether it is secure to proceed the file that the user has uploaded.

Upload Folder within www

Don't want your folder to be located outside of www or public_html? There is another solution for this. However, you might need to have dedicated or vps which has root access in order for this to work. Rather than giving write permission to the users, we give to apache instead. You can do this with a chown on the writable folder to apache or nobody and assign 770 permission.

Basically, this will disable public access to file in the directory. Short to say, external users will not be able to execute, read or write on the directory, only Apache is allowed to since it is the owner of the folder.

My Upload Handler

This is the upload handler that i usually rely on which you might be interested.

<?php
	#check for session
	if (isset($_POST['PHPSESSID'])) 
		session_id($_POST['PHPSESSID']);
	else if (isset($_GET['PHPSESSID'])) 
		session_id($_GET['PHPSESSID']);
	else
	{
		HandleError('No Session was found.');
	}
	session_start();
// Check post_max_size (http://us3.php.net/manual/en/features.file-upload.php#73762)
	$POST_MAX_SIZE = ini_get('post_max_size');
	$unit = strtoupper(substr($POST_MAX_SIZE, -1));
	$multiplier = ($unit == 'M' ? 1048576 : ($unit == 'K' ? 1024 : ($unit == 'G' ? 1073741824 : 1)));

	if ((int)$_SERVER['CONTENT_LENGTH'] > $multiplier*(int)$POST_MAX_SIZE && $POST_MAX_SIZE) 
		HandleError('POST exceeded maximum allowed size.');
	
// Settings
	$save_path = getcwd() . '/uploads/';				// The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
	$upload_name = 'Filedata';							// change this accordingly
	$max_file_size_in_bytes = 2147483647;				// 2GB in bytes
	$whitelist = array('jpg', 'png', 'gif', 'jpeg'); 	// Allowed file extensions
	$backlist = array('php', 'php3', 'php4', 'phtml','exe'); // Restrict file extensions
	$valid_chars_regex = 'A-Za-z0-9_-\s ';// Characters allowed in the file name (in a Regular Expression format)
	
// Other variables	
	$MAX_FILENAME_LENGTH = 260;
	$file_name = '';
	$file_extension = '';
	$uploadErrors = array(
        0=>'There is no error, the file uploaded with success',
        1=>'The uploaded file exceeds the upload_max_filesize directive in php.ini',
        2=>'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form',
        3=>'The uploaded file was only partially uploaded',
        4=>'No file was uploaded',
        6=>'Missing a temporary folder'
	);

// Validate the upload
	if (!isset($_FILES[$upload_name])) 
		HandleError('No upload found in \$_FILES for ' . $upload_name);
	else if (isset($_FILES[$upload_name]['error']) && $_FILES[$upload_name]['error'] != 0) 
		HandleError($uploadErrors[$_FILES[$upload_name]['error']]);
	else if (!isset($_FILES[$upload_name]['tmp_name']) || !@is_uploaded_file($_FILES[$upload_name]['tmp_name'])) 
		HandleError('Upload failed is_uploaded_file test.');
	else if (!isset($_FILES[$upload_name]['name']))
		HandleError('File has no name.');

// Validate the file size (Warning: the largest files supported by this code is 2GB)
	$file_size = @filesize($_FILES[$upload_name]['tmp_name']);
	if (!$file_size || $file_size > $max_file_size_in_bytes)
		HandleError('File exceeds the maximum allowed size');
	
	if ($file_size <= 0)
		HandleError('File size outside allowed lower bound');
// Validate its a MIME Images (Take note that not all MIME is the same across different browser, especially when its zip file) 
	if(!eregi('image/', $_FILES[$upload_name]['type'])) 
		HandleError('Please upload a valid file!');

// Validate that it is an image
	$imageinfo = getimagesize($_FILES[$upload_name]['tmp_name']);
	if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg' && $imageinfo['mime'] != 'image/png' && isset($imageinfo)) 
		HandleError('Sorry, we only accept GIF and JPEG images');

// Validate file name (for our purposes we'll just remove invalid characters)
	$file_name = preg_replace('/[^'.$valid_chars_regex.']|\.+$/i', '', strtolower(basename($_FILES[$upload_name]['name'])));
	if (strlen($file_name) == 0 || strlen($file_name) > $MAX_FILENAME_LENGTH)
		HandleError('Invalid file name');

// Validate that we won't over-write an existing file
	if (file_exists($save_path . $file_name))
		HandleError('File with this name already exists');

// Validate file extension
	if(!in_array(end(explode('.', $file_name)), $whitelist))
		HandleError('Invalid file extension');
	if(in_array(end(explode('.', $file_name)), $backlist))
		HandleError('Invalid file extension');
// Rename the file to be saved	
	$file_name = md5($file_name. time());
	
// Verify! Upload the file
	if (!@move_uploaded_file($_FILES[$upload_name]['tmp_name'], $save_path.$file_name)) {
		HandleError('File could not be saved.');
	}
	exit(0);

/* Handles the error output. */
function HandleError($message) {
	echo $message;
	exit(0);
}
?>

Conclusion

This is not a full proof solution for your file upload handler. However, this can used as references and also discussion that can help enhance the overall security of our web application today.

Cross Browser Compatible CSS Opacity

This is something that i like to write down on my site; cross browser CSS opacity. CSS opacity is used on my daily web development almost every single time. Every time when i need a cross browser opacity solution, i will have to search on Google and try to remember which one is the one that i previously used, that worked for all browsers. There is never a permanent updated solution on Google that is constantly updated with the latest browser. Most of them are written centuries ago. Things have changed. Many new versions and browsers have also emerged. I need a cross browser compatible opacity solution that is updated and works.

IE 8 changes

IE 8 has changed CSS Opacity a little. The old CSS declaration might not cause your div block and images to fade like it used to do. In IE8, a new declaration will have to be formed.

.myclassname /* classname */
{ 
-moz-opacity:.70; 
-ms-filter:”alpha(opacity=70)”; 
filter:alpha(opacity=70); 
opacity:.70; 
}

Please visit the IEBlog for more information on IE 8 changes.

Cross Browser Opacity Declaration

The updated solution for cross browser compatible opacity solution that worked on older and newer browsers is:

.myclassname /* classname */
{ 
	filter: alpha(opacity:0.7);
	KHTMLOpacity: 0.7;
	MozOpacity: 0.7;
	-khtml-opacity:.70; 
	-ms-filter:”alpha(opacity=70)”; 
	-moz-opacity:.70; 
	filter:alpha(opacity=70); 
	opacity:.70;
}

The above declaration support 1.x versions of Safari and both newer and older browser too. It has been tested on,

  • Standard: FF gt 1.5, Opera, Safari
  • IE lt 8
  • IE 8
  • Safari 1.x
  • FF lt 1.5, Netscape
  • Flock 1.2+
  • Iceweasel 2.x
  • Dillo 0.x
  • Minefield 3.x
  • Chrome 1.x
  • k-Melon 1.x
  • SeaMonkey 1.x
  • Shiretoko 3.x

Tutorial: Function within a function in JavaScript

Do you know that you can define a function within a function in JavaScript? Furthermore, these functions defined in the outer function are not accessible outside the scope unless you expose them to the outside scope? This is pretty interesting since basic web tutorial doesn't really cover function in a function with JavaScript. Function in a function are only noticeable when you come across or read about in the real world of JavaScript application.

Function within a function

How do you define a function within a function in JavaScript? Pretty simple and straight forward actually. Just throw another function into the function. This will caused the inner function to be accessible only within the scope of outer function.

function outer_func(){
	function inner_func(){
		alert('hellow');
	}
	//hellow will be alert
	inner_func();
}

If you try to access the inner function, an undefined error will occurs. On the other hand, using the outer function still permits.

//undefined function
inner_func();
//alert 'hellow'
outer_func();

Access the inner functions

Sometimes we want some methods in the outer function to be accessible. We will have to return an object with the relevant method attached to it for it to be accessible outside the scope.

function outer_func(){
	var newObj = new Object() 
	function inner_func(){
		alert('hellow');
	}
	function inner_func2(){
		alert('RAWR!');
	}
	newObj.inner_func = inner_func;
	return newObj;
}

Above, we created two function and only attached the first function into the return object. Thus, calling the second function will fail.

var func_Obj = new outer_func();
// alert 'hellow'
func_Obj.inner_func();
//undefined
func_Obj.inner_func2();

Some Real World Application

Function within a function act as a security measure for certain action to be restricted outside the scope. Open source code tend to use this to prevent certain dependency methods from being access. Performing certain organization through this method was also applied in real life application.