Find malware on your web server/shared hosting

Some of my client websites get hacked. Some shared hosting providers provide some virus scanning tools, but it’s not always enough and what about those who even don’t provide malware scanning. Hopefully they provide SSH access and AI-BOLIT can be used. It’s a free website virus and malware scanner for websites.
Just download it, unzip and upload to your desired host. Copy it into the root directory of your website.
Last run it
php ai-bolit.php --mode=2
or not paranoid/normal mode
php ai-bolit.php

Advertisements

Learning something new every morning

Thanks to Enki app I learn something new in programming every day. Give it a try.

Dev tip: Learn VIM

So happy that I know how to use VIM. Why? Because sometimes I need to edit files on the remote host.
Maybe your IDE can’t successfully connect to the remote host and you end up with SSH and CLI commands.
My current scenario is implementing a payment gateway and using localhost as host is ignored 😦 I ended up coding on the shared hosting via SSH, but without slowdown thanks to VIM skills.

Splitting zsh config due multi host usage

This week while copying some of my dotfiles (due vim and zsh configuration) to a new remote host (dedicated server) of a new client I had to remove the private stuff (mainly aliases) from my .zshrc. Only now did the muse hit me to split the file and leverage the source (import, require, include) functionality.

So I moved the host specific and private stuff from .zshrc and added the following 2 lines after source $ZSH/oh-my-zsh.sh:

[[ -f .zshrc_priv ]] && source .zshrc_priv
[[ -f .zshrc_host ]] && source .zshrc_host

After editing .zshrc and moving some lines into .zshrc_priv and .zshrc_host I also commented the files header to be reminded about their purpose in the future 😀

# .zshrc_priv
# Sourced by .zshrc
# Private settings due public version control

alias vps='TERM=xterm-256color autossh -M 0 mike@vps' # host vps set in .ssh/config
alias vps_tunnel='autossh -f -M 0 -T -N -R 10022:localhost:22 mike@vps'

# .zshrc_host
# Sourced by .zshrc
# Host specific settings

export PATH="/usr/local/opt/node@6/bin:$PATH

Next I gonna separate some vim plugin specific code, too, to have a copyable (Plug & Play) config.

Livereload WordPress PHP code during development

I got tired of reloading 2 browser windows (one incognito) during development. I saw one fellow developer using Livereload in his code so I gave it a try.

Boy was that a good/effective idea.

1. Create package.json file with npm init
   in your project dir.
2. Add line "livereload": "^0.6.2" to devDependencies and "dev": "livereload -d wp-content", to scripts

   {
     "name": "example.com",
     "version": "1.0.0",
     "description": "",
     "dependencies": {
     },
     "devDependencies": {
       "livereload": "^0.6.2"
     },
     "scripts": {
       "dev": "livereload -d wp-content",
       "test": "echo \"Error: no test specified\" && exit 1"
     },
     "repository": {
       "type": "git",
       "url": "git+ssh://git@bitbucket.org/exampleUser/example.git"
     },
     "author": "Michal Zuber",
     "license": "MIT"
   }
   

3. Install livereload package npm install
4. Next add LiveReload Chrome extension
5. Run npm run dev or yarn dev
6. Open project URL in browser and click LiveReload extension icon to connect with livereload. Example console output when handshake was successful

   yarn dev v0.28.4
   $ livereload -d wp-content
   LiveReload is waiting for browser to connect.
   
   Protocol version: 7
   Exclusions: /\.git\//,/\.svn\//,/\.hg\//
   Extensions: html,css,js,png,gif,jpg,php,php5,py,rb,erb,coffee
   Polling: false
   
   
   Starting LiveReload v0.6.2 for /srv/http/example.com/-d on port 35729.
   Watching /srv/http/example.com/-d...
   
   Browser connected.
   
   Client message: {"command":"hello","protocols":["http://livereload.com/protocols/official-6","http://livereload.com/protocols/official-7"],"ver":"2.2.2","ext":"Chrome","extver":"2.1.0"}
   
   Client requested handshake...
   
   Handshaking with client using protocol 7...
   
   Client message: {"command":"info","plugins":{"less":{"disable":false,"version":"1.0"}},"url":"http://localhost/example.com/test-page/"}
   

Listing phpcs rules and excluding commenting sniff

While testing WordPress-Coding-Standards PHP_CodeSniffer rules (sniffs) to enforce WordPress coding conventions the following command came handy. It lists all enabled rules:

phpcs --standard=phpcs.xml -e

Output example

The WordPress Project standard contains 100 sniffs

Generic (34 sniffs)
-------------------
  Generic.Classes.DuplicateClassName
  Generic.Classes.OpeningBraceSameLine
  Generic.CodeAnalysis.EmptyStatement
  Generic.CodeAnalysis.ForLoopShouldBeWhileLoop
  Generic.CodeAnalysis.ForLoopWithTestFunctionCall
  Generic.CodeAnalysis.JumbledIncrementer
  Generic.CodeAnalysis.UnconditionalIfStatement
  Generic.CodeAnalysis.UnnecessaryFinalModifier
  Generic.CodeAnalysis.UnusedFunctionParameter
  Generic.CodeAnalysis.UselessOverridingMethod
  Generic.Commenting.DocComment
  Generic.Commenting.Fixme
  Generic.Commenting.Todo
  Generic.ControlStructures.InlineControlStructure
  Generic.Files.ByteOrderMark
  Generic.Files.EndFileNewline
  Generic.Files.LineEndings
  Generic.Formatting.DisallowMultipleStatements
  Generic.Formatting.SpaceAfterCast
  Generic.Functions.CallTimePassByReference
  Generic.Functions.OpeningFunctionBraceKernighanRitchie
  Generic.NamingConventions.UpperCaseConstantName
  Generic.PHP.BacktickOperator
  Generic.PHP.DeprecatedFunctions
  Generic.PHP.DisallowAlternativePHPTags
  Generic.PHP.DisallowShortOpenTag
  Generic.PHP.ForbiddenFunctions
  Generic.PHP.LowerCaseConstant
  Generic.PHP.LowerCaseKeyword
  Generic.PHP.NoSilencedErrors
  Generic.PHP.Syntax
  Generic.Strings.UnnecessaryStringConcat
  Generic.WhiteSpace.DisallowSpaceIndent
  Generic.WhiteSpace.ScopeIndent

PEAR (2 sniffs)
---------------
  PEAR.Functions.FunctionCallSignature
  PEAR.NamingConventions.ValidClassName

PSR2 (3 sniffs)
---------------
  PSR2.ControlStructures.ElseIfDeclaration
  PSR2.ControlStructures.SwitchDeclaration
  PSR2.Files.ClosingTag

Squiz (26 sniffs)
-----------------
  Squiz.Classes.SelfMemberReference
  Squiz.Commenting.BlockComment
  Squiz.Commenting.ClassComment
  Squiz.Commenting.ClosingDeclarationComment
  Squiz.Commenting.DocCommentAlignment
  Squiz.Commenting.EmptyCatchComment
  Squiz.Commenting.FileComment
  Squiz.Commenting.FunctionComment
  Squiz.Commenting.FunctionCommentThrowTag
  Squiz.Commenting.InlineComment
  Squiz.Commenting.VariableComment
  Squiz.ControlStructures.ControlSignature
  Squiz.Functions.FunctionDeclarationArgumentSpacing
  Squiz.Functions.FunctionDuplicateArgument
  Squiz.Operators.IncrementDecrementUsage
  Squiz.Operators.ValidLogicalOperators
  Squiz.PHP.CommentedOutCode
  Squiz.PHP.DisallowMultipleAssignments
  Squiz.PHP.DisallowSizeFunctionsInLoops
  Squiz.PHP.EmbeddedPhp
  Squiz.PHP.Eval
  Squiz.PHP.NonExecutableCode
  Squiz.Strings.ConcatenationSpacing
  Squiz.Strings.DoubleQuoteUsage
  Squiz.WhiteSpace.CastSpacing
  Squiz.WhiteSpace.SuperfluousWhitespace

WordPress (35 sniffs)
---------------------
  WordPress.Arrays.ArrayDeclarationSpacing
  WordPress.Arrays.ArrayIndentation
  WordPress.Arrays.ArrayKeySpacingRestrictions
  WordPress.Arrays.CommaAfterArrayItem
  WordPress.CSRF.NonceVerification
  WordPress.Classes.ClassInstantiation
  WordPress.CodeAnalysis.EmptyStatement
  WordPress.DB.RestrictedClasses
  WordPress.DB.RestrictedFunctions
  WordPress.Files.FileName
  WordPress.Functions.DontExtract
  WordPress.Functions.FunctionCallSignatureNoParams
  WordPress.NamingConventions.PrefixAllGlobals
  WordPress.NamingConventions.ValidFunctionName
  WordPress.NamingConventions.ValidHookName
  WordPress.NamingConventions.ValidVariableName
  WordPress.PHP.DevelopmentFunctions
  WordPress.PHP.DiscouragedPHPFunctions
  WordPress.PHP.POSIXFunctions
  WordPress.PHP.StrictComparisons
  WordPress.PHP.StrictInArray
  WordPress.PHP.YodaConditions
  WordPress.Variables.GlobalVariables
  WordPress.WP.AlternativeFunctions
  WordPress.WP.CapitalPDangit
  WordPress.WP.DeprecatedClasses
  WordPress.WP.DeprecatedFunctions
  WordPress.WP.DeprecatedParameters
  WordPress.WP.DiscouragedFunctions
  WordPress.WP.EnqueuedResources
  WordPress.WP.I18n
  WordPress.WP.PreparedSQL
  WordPress.WhiteSpace.CastStructureSpacing
  WordPress.WhiteSpace.DisallowInlineTabs
  WordPress.WhiteSpace.OperatorSpacing

Now I can disable that annoys me 🙂

 

Spacecraft software

Finally came across an article which describes now is software written for spacecrafts.

In the modern software environment, 80% of the cost of the software is spent after the software is written the first time — they don’t get it right the first time, so they spend time flogging it. In shuttle, they do it right the first time. And they don’t change the software without changing the blueprint. That’s why their software is so perfect.

Software is getting more and more common and more and more important, but it doesn’t seem to be getting more and more reliable.

money is not the critical constraint: the groups $35 million per year budget is a trivial slice of the NASA pie, but on a dollars-per-line basis, it makes the group among the nation’s most expensive software organizations

From http://www.fastcompany.com/magazine/06/writestuff.html