Macrotone Blogs

Macrotone blogs upon Joomla, our products and other matters.
Categories
Tags
Archives
Calendar
Categories:   All Categories
Suggested keywords
x
Geoffrey Chapman

Google translate and Joomla

We have recently placed a new module upon our site to enable page translations using the Google translate service for the benefit of our foreign visitors.

Whilst working fine in Firefox (version 19.0.2), Opera (12.14) and Internet Explorer (10), with the translated page being present with our usual page layout format, we notice that when using Google Chrome browser (version 25.0.1364.172 m), that the information is translated, but the page formatting is completely lost.  This may be a conflict with the inbuilt translation available with the Chrome browser.

There are a few aspects to this.

1. Google translate is not retaining the site 'format' hence the display is not as on the originating site.

2. Being a site in Europe we are obliged to have a message re the use of Cookies upon the site. When the page is translated it then appears to come from our site but in fact is displayed from the 'translate.googleusercontent.com' site.  Since the 'translation site' is using 'our template the request for Cookie acceptance is initiated, regardless of whether the user has accepted cookies previously, since it is effectively 'a new site'.  However even accepting the cookie does not remove the 'acceptance message' since there appears to be some form of page 'caching' upon the translate.googleusercontent.com site.  This cache we have no control over hence the 'cookie' message is still displayed on the translated page.

[See blog post about associate problem with cache and cookie handling.]

Tags:
browser joomla cookies Europe
Geoffrey Chapman

EU Cookie regulations and Joomla system page cache

We have noticed a problem on our site related to cookie handling and the Firefox (version 19.0.2) and Chrome (version 25.0.1364.172 m) and the cookies generated by the EU cookie plugin required to meet EU regulations.

The problem, which is (we believe) caused by the use of the Joomla system (page) cache manifest itself either as no EU message being displayed, to enable acceptance of the cookie, or as the cookie acceptance appearing to be ignored (even though it has been accepted) and the message continuing to be displayed.  Option changes to the system cache plugin do not make any difference.

Not a show stopper but a problem none the less.  The problem although first noticed on our own site is also evident on other sites complying with the EU regulations and using cookies.

Continue reading
Tags:
cookies PECR regulations joomla browser
Geoffrey Chapman

CSS Sprites

For those that have been using our Issue Tracker component, they are aware that we have invested a certain amount of time improving the look of the front end screens of the component.   With the emphasis now turning to the changes required for Joomla3.x we recently looked at using CSS sprites.

If you are not familiar with Sprites, they can be thought of as one ‘large’ image containing lots of smaller images.  The theory being that loading one image is a lot quicker than loading a lot of small images and save bandwidth.  The individual images enclosed within the large ‘image’ are accessed by specifying its position within the larger file.

There is a simple article which explains this is slightly more detail, so it is not worth repeating it here. In actual fact there are a lot of articles scattered over the web that go into the use of Sprites, of mixed usage.

One might think that it is a lot of work creating the ‘combined image’ and its references, but there are a number of sites on the web that perform most of the work for you.  We have tried a number of them with varying success.  One of the better ones (in our opinion) is Zero Sprites which creates quite a nice compact combined image and generates the required CSS lines for one to customise and use in ones application.

We have got this all working ourselves, but observe that on a number of web sites we visit that even if we use sprites ourselves the impact on the site as a whole is often minimal since there are so many other ‘components/modules’ etc.  in use that our images are often only a fraction of those in use.  Having said that there is a saying that ‘every little bit helps’ so with that in mind the work involved must be worth it.

Tags:
developers CSS joomla
Geoffrey Chapman

Experiences with CSS and a table style

Whilst working on presenting a sample table style for our Issue Tracker component one particular colour combination was creating a few problems. The main problem was the colour of the links in the table header.  These would be used to sort the list and due to the choice of colour scheme the link colours were taking the settings from an earlier (in the tree)  DIV style.

This resulted in us temporarily shelving the table style until such time as we had to investigate further.  With the release of 1.3 of Issue Tracker we have now turned our attention back to the style sheet. The investigation was interesting and it is likely that others might benefit from our experiences hence the decision to make it a Blog post.

The resolution was to make use of the  !important declaration which been around since CSS1 but should still be used with caution.

Continue reading
Tags:
Tools tables joomla Issue Tracker CSS
Geoffrey Chapman

Detected intrusion attempts

We have detected an unusual (for us) sudden spate of web attacks on our site by hackers which we thought we would share with the community.

These attacks have taken a different route to those we normally see. They have basically fallen into two separate categories:

Malicious User Agent:  
This attack vector describes where a hacker tries to access the site using a browser configured to send malicious PHP code in its user agent string (a small piece of text used to describe the browser to your server).  The idea behind it is that buggy log processing software will parse it and allow the hacker to gain control of the website.

Direct File Inclusion:
In this attack vector a hacker tries to trick vulnerable components into loading arbitrary files. Depending on the vulnerable component, the file will either be output verbatim or parsed as a PHP file. This allows attackers to disclose sensitive information about the site or to run malicious code uploaded to the site through another vulnerable vector, e.g. an unfiltered upload of executable PHP code.

Tags:
website joomla security
Geoffrey Chapman

DBMS_FEATURE_USAGE_REPORT

oracleRead an interesting article/blog post upon the Oracle package DBMS_FEATURE_USAGE_REPORT that once one ignored the ‘Star Wars’ trivia, brought back recollections of the scripts that I used to run to achieve the same results. i.e.  Produce evidence that the company was only using certain features of the Oracle product, which in turn influenced the ‘price’ that one paid to Oracle Corporation for the licenses.

Tags:
Oracle DBA
Geoffrey Chapman

Strange PHP error on live web site.

Noticed late yesterday a strange error occurring on our website when a specific article was accessed.

image

 

The error is :  DateTime::__construct(): Failed to parse time string (about 5 months ago) at position 0 (a): The timezone could not be found in the database

 

Nothing had been changed on the page for some time so I think this is some form of PHP bug.  [Currently running 5.4.11].

To resolve it I had to copy the offending article and then just point the menu items to the copy.  This indicates that it wasn’t anything specific about the article itself that was wrong.

Since the error is not specifically related to something that I/we have done, it is obviously something to report to the hosting company.

Not reproducible on any of our test instances, and of course it had to occur on the ‘live site’.  Isn’t that always the way. Smile

Tags:
PHP joomla
Geoffrey Chapman

Private IP addresses visible on Internet?

This should not happen, BUT we have observed a few private IP addresses being used by visitors to our site.

An IP address is considered private if the IP number falls within one of the IP address ranges reserved for private uses by Internet standards groups. The following  private IP address ranges exist:

      10.0.0.0 to 10.255.255.255
      169.254.0.0 to 169.254.255.255 (APIPA only)
      172.16.0.0 to 172.31.255.255
    192.168.0.0 to 192.168.255.255

These private IP addresses are (normally) used on local networks which includes homes, schools business LANs etc.  Devices with private IP addresses cannot (should not be possible to) connect directly to the Internet. Similarly devices outside of the local network cannot (should not be able to) connect directly to a device with a private IP.  Typically access to such devices are brokered by a router or similar device that supports Network Address Translation (NAT).  NAT effectively hides the private IP numbers but can selectively transfer messages to these devices, affording a layer of security to the local network.

Standards groups created the private IP addressing to prevent a shortage of public IP addresses available to Internet service providers and subscribers.

So given that these private IP addresses should not be visible on the Internet, how is it possible therefore for our site to have recorded access from devices with addresses in the 10.x.x.x and 192.168.x.x ranges? 

One can always block these devices from access to web pages by including the private address ranges within ‘blocked’ ranges, using commonly available tools available upon the web, but it still doesn’t explain how there are visible in the first place! If in doubt it is possibly wise to block them as a matter of course for a site on the Internet. Remember if the site is on a ‘local’ LAN that blocking them is not an option.

One wonders if there is a connection with the implementation of IP v6, and whether somehow these address ranges are getting through.  Alternatively perhaps a particular NAT provisioning mechanism is faulty?  Another possibility is that  dubious entities are using them to ‘mask’ their activities.  We are led to the latter possibility since the 10.x.x.x devices were attempting access to our site ‘back end’.

Despite some extensive searching we do not currently know the source of these connections, which raises a few possibly serious security concerns. We will continue our investigations.

Tags:
security Privacy Communications
Geoffrey Chapman

Doing more with LESS.

http://lesscss.org/images/logo.pngAs part of our ongoing work on our Joomla components we have been looking at the ‘next’ logical change that we want to implement with the CCS styles.  This is of course making use of the LESS compiler.

What is LESS you might ask.  Well LESS is a dynamic stylesheet language, which extends CSS with dynamic behaviour such as variables, mixins, operations and functions.  It can run upon both the server-side or client-side (modern browsers only) on a site.

Continue reading
Tags:
browser developers
Geoffrey Chapman

Web Standards

   I am reminded of the quote “The nice thing about standards is that there are so many of them to choose from.” attributed to  “Andrew S. Tanenbaum”, whilst looking into the structure of web pages.

The Firefox browser add in ‘FireBug’ provides a nice tool under ‘Tools- Validate HTML’ which enables the page one is viewing to be checked by the W3C Markup Validation Service.   By default it uses the standard defined at the start of most web pages, but the number and variety of possible standards is most interesting.  The output is a nice listing of ‘errors' and ‘warnings’ upon the page structure and its elements. [Note that it excludes the ‘new’ standards mentioned below, although it does have ‘HTML5 Experimental’]

Whilst one can then proceed to correct and eliminate the errors and warnings it does raise the question as to what standard should one be writing web pages to:  HTML5, XHTML 1.0 Transitional, XHTHL 1.0 Standard, XHTML 1.0 Framework, HTML 4.01 Strict etc.  The list goes on to provide about 15 possible standards.

Continue reading
Tags:
Tools Javascript browser compliance regulations
Go To Top

Joomla! Debug Console

Session

Profile Information

Memory Usage

Database Queries