amazo's People
Forkers
celinelobbanamazo's Issues
Use timing-safe string comparison instead of === in your CSRF token validator:
https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L605
Instead of ===, use hash_equals() http://php.net/manual/en/function.hash-equals.php (requires PHP 5.6)
Use a named immutable configuration object, not an array
https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L37
By doing this, you let the language do the validating for you, no need to validate it yourself.
$config = new Amazo\Config('dbUser', 'dbPassword', 'dbDSN'); $amazo = new Amazo\Amazo($config);
Where Amazo\Amazo constructor typehints for Amazo\Config. And since Amazo\Config's constructor requires you to supply it with those arguments, you can be guaranteed that Amazo\Amazo has been constructed correctly. No need to validate an array. Leverage the language instead.
generatePassCost should be optional. Developer should use it in dev to find best cost
https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L330
That's fine for testing things out and then setting the cost as a configuration option, but doing it on the fly is simply not good. It's being called multiple times, which completely defeats the purpose of trying to stick to a specific time cost!
The purpose of the 50ms rule of thumb is that it's just long enough to mitigate brute force if the database is breached, but not so costly that it would create a DOS vulnerability. If you're simply guessing every time it's run, then you're making the server do more work anyway.
Instruct the developer to use it as a utility on their production environment to determine what value to set ahead of time, and then set that value as configuration. Never call generatePassCost() in your code.
Inside of Amazo\Amazo, don't re-assign config
https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L67-L69
Simply store the config object, and then call it as needed:
$this->config->getDBUsername();
Simplify your return statements
https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L148
This:
if($stmt->rowCount() > 0)
{
return true;
}
return false;
Is exactly the same as this:
return $stmt->rowCount() > 0;
Another example: https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L361-L369
Can simply be written as:
return !preg_match('/[^A-Za-z0-9]/', $string);
typo
You are referencing $GET when you really mean $_GET. code snippet:
if(isset($_POST[$crfname]) || isset($GET[$crfname]))
Fix other inconsistencies
In some places you have if( and in others you have if ( (notice the space between the parens and the keyword?)
Be consistent in everything you do.
use guard clause and return early
https://github.com/kemoycampbell/amazo/blob/master/src/Amazo/Amazo.php#L593-L631
Nested conditionals like this can be drastically simplified. Look up "guard clauses" and "return early".
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.