Comments (5)
it shouldn't be
please fix and push
Notice: This message is digitally signed, its source and integrity are verifiable.
If you mail client does not support S/MIME verification, it will display a file (smime.p7s), which includes the X.509 certificate and the signature body. Read more at Certified E-Mail with Comodo and Thunderbird in AbiusX.com
On Mordad 22, 1392, at 4:38 AM, SvenRtbg [email protected] wrote:
Why "echof" near line 230?
echof(fread($f, $advanceBy)); //read the specified number of bytes.
—
Reply to this email directly or view it on GitHub.
from phpsec.
Doubt: The purpose of this function is to serve data in pieces to the
browser. By using "echo" we were redirecting the data to the console. But
how is this data going back to the browser in these pieces. What I am
asking is suppose the user asked me to read bytes 1000 to 5000. My
bandwidth limit is to read 1000 bytes at once and resumable flag is true. So,
every time 1000 bytes are read, will that data be directly passed to the
browser, or the system will wait till all the data is been collected and
then send to the browser?? But then what is the difference between
resumable flag on or off. It just specifies how many bytes to read. How
will the browser actually resume download ?? My guess to the second
question is that the secret lies in how many bytes read. If resumable is
on, then less bytes will be read at a time and so if the user pauses
download, then the fseek will tell the last position till data has been
read. But with reading large bytes at a time, the problem is that if
paused, you again have to read the whole data.
On Tue, Aug 13, 2013 at 5:42 AM, AbiusX [email protected] wrote:
it shouldn't be
please fix and push
Notice: This message is digitally signed, its source and integrity are
verifiable.
If you mail client does not support S/MIME verification, it will display a
file (smime.p7s), which includes the X.509 certificate and the signature
body. Read more at Certified E-Mail with Comodo and Thunderbird in
AbiusX.comOn Mordad 22, 1392, at 4:38 AM, SvenRtbg [email protected]
wrote:Why "echof" near line 230?
echof(fread($f, $advanceBy)); //read the specified number of bytes.
—
Reply to this email directly or view it on GitHub.—
Reply to this email directly or view it on GitHubhttps://github.com//issues/60#issuecomment-22535336
.
Regards,
Rahul Chaudhary
Ph - 412-519-9634
from phpsec.
you're wrong on this.
first, apache handles the output from php to the browser. you just need to flush it if you want it received.
second, resumable downloads are handled using HTTP_RANGE, i.e the browser asks for bytes 1000 to 5000, and server serves those bytes.
-A
Notice: This message is digitally signed, its source and integrity are verifiable.
If you mail client does not support S/MIME verification, it will display a file (smime.p7s), which includes the X.509 certificate and the signature body. Read more at Certified E-Mail with Comodo and Thunderbird in AbiusX.com
On Mordad 22, 1392, at 12:28 PM, Rahul Chaudhary [email protected] wrote:
Doubt: The purpose of this function is to serve data in pieces to the
browser. By using "echo" we were redirecting the data to the console. But
how is this data going back to the browser in these pieces. What I am
asking is suppose the user asked me to read bytes 1000 to 5000. My
bandwidth limit is to read 1000 bytes at once and resumable flag is true. So,
every time 1000 bytes are read, will that data be directly passed to the
browser, or the system will wait till all the data is been collected and
then send to the browser?? But then what is the difference between
resumable flag on or off. It just specifies how many bytes to read. How
will the browser actually resume download ?? My guess to the second
question is that the secret lies in how many bytes read. If resumable is
on, then less bytes will be read at a time and so if the user pauses
download, then the fseek will tell the last position till data has been
read. But with reading large bytes at a time, the problem is that if
paused, you again have to read the whole data.On Tue, Aug 13, 2013 at 5:42 AM, AbiusX [email protected] wrote:
it shouldn't be
please fix and push
Notice: This message is digitally signed, its source and integrity are
verifiable.
If you mail client does not support S/MIME verification, it will display a
file (smime.p7s), which includes the X.509 certificate and the signature
body. Read more at Certified E-Mail with Comodo and Thunderbird in
AbiusX.comOn Mordad 22, 1392, at 4:38 AM, SvenRtbg [email protected]
wrote:Why "echof" near line 230?
echof(fread($f, $advanceBy)); //read the specified number of bytes.
—
Reply to this email directly or view it on GitHub.—
Reply to this email directly or view it on GitHubhttps://github.com//issues/60#issuecomment-22535336
.Regards,
Rahul Chaudhary
Ph - 412-519-9634
—
Reply to this email directly or view it on GitHub.
from phpsec.
ummm...actually thats my doubt:
-
We need to flush the o/p. So then using echo is wrong ?? What should we
use ? -
How does the server serves the file. I mean how it does it internally.
HTTP-Range specifies what bytes to read, I read the files, flushed the read
bytes...and server serves it. Just like that...??
On Tue, Aug 13, 2013 at 1:38 PM, AbiusX [email protected] wrote:
you're wrong on this.
first, apache handles the output from php to the browser. you just need to
flush it if you want it received.
second, resumable downloads are handled using HTTP_RANGE, i.e the browser
asks for bytes 1000 to 5000, and server serves those bytes.
-A
Notice: This message is digitally signed, its source and integrity are
verifiable.
If you mail client does not support S/MIME verification, it will display a
file (smime.p7s), which includes the X.509 certificate and the signature
body. Read more at Certified E-Mail with Comodo and Thunderbird in
AbiusX.comOn Mordad 22, 1392, at 12:28 PM, Rahul Chaudhary [email protected]
wrote:Doubt: The purpose of this function is to serve data in pieces to the
browser. By using "echo" we were redirecting the data to the console.
But
how is this data going back to the browser in these pieces. What I am
asking is suppose the user asked me to read bytes 1000 to 5000. My
bandwidth limit is to read 1000 bytes at once and resumable flag is
true. So,
every time 1000 bytes are read, will that data be directly passed to the
browser, or the system will wait till all the data is been collected and
then send to the browser?? But then what is the difference between
resumable flag on or off. It just specifies how many bytes to read. How
will the browser actually resume download ?? My guess to the second
question is that the secret lies in how many bytes read. If resumable is
on, then less bytes will be read at a time and so if the user pauses
download, then the fseek will tell the last position till data has been
read. But with reading large bytes at a time, the problem is that if
paused, you again have to read the whole data.On Tue, Aug 13, 2013 at 5:42 AM, AbiusX [email protected]
wrote:it shouldn't be
please fix and push
Notice: This message is digitally signed, its source and integrity are
verifiable.
If you mail client does not support S/MIME verification, it will
display a
file (smime.p7s), which includes the X.509 certificate and the
signature
body. Read more at Certified E-Mail with Comodo and Thunderbird in
AbiusX.comOn Mordad 22, 1392, at 4:38 AM, SvenRtbg [email protected]
wrote:Why "echof" near line 230?
echof(fread($f, $advanceBy)); //read the specified number of bytes.
—
Reply to this email directly or view it on GitHub.—
Reply to this email directly or view it on GitHub<
https://github.com/OWASP/phpsec/issues/60#issuecomment-22535336>
.Regards,
Rahul Chaudhary
Ph - 412-519-9634
—
Reply to this email directly or view it on GitHub.—
Reply to this email directly or view it on GitHubhttps://github.com//issues/60#issuecomment-22549139
.
Regards,
Rahul Chaudhary
Ph - 412-519-9634
from phpsec.
- echo is fine. echof is also fine, but is usually intended for HTML output to be XSS-safe.
- yes. you just output them and die. apache will buffer and deliver to browser. if browser cancels, apache also sends exit signal to your php app.
Notice: This message is digitally signed, its source and integrity are verifiable.
If you mail client does not support S/MIME verification, it will display a file (smime.p7s), which includes the X.509 certificate and the signature body. Read more at Certified E-Mail with Comodo and Thunderbird in AbiusX.com
On Mordad 22, 1392, at 12:44 PM, Rahul Chaudhary [email protected] wrote:
ummm...actually thats my doubt:
We need to flush the o/p. So then using echo is wrong ?? What should we
use ?How does the server serves the file. I mean how it does it internally.
HTTP-Range specifies what bytes to read, I read the files, flushed the read
bytes...and server serves it. Just like that...??On Tue, Aug 13, 2013 at 1:38 PM, AbiusX [email protected] wrote:
you're wrong on this.
first, apache handles the output from php to the browser. you just need to
flush it if you want it received.
second, resumable downloads are handled using HTTP_RANGE, i.e the browser
asks for bytes 1000 to 5000, and server serves those bytes.
-A
Notice: This message is digitally signed, its source and integrity are
verifiable.
If you mail client does not support S/MIME verification, it will display a
file (smime.p7s), which includes the X.509 certificate and the signature
body. Read more at Certified E-Mail with Comodo and Thunderbird in
AbiusX.comOn Mordad 22, 1392, at 12:28 PM, Rahul Chaudhary [email protected]
wrote:Doubt: The purpose of this function is to serve data in pieces to the
browser. By using "echo" we were redirecting the data to the console.
But
how is this data going back to the browser in these pieces. What I am
asking is suppose the user asked me to read bytes 1000 to 5000. My
bandwidth limit is to read 1000 bytes at once and resumable flag is
true. So,
every time 1000 bytes are read, will that data be directly passed to the
browser, or the system will wait till all the data is been collected and
then send to the browser?? But then what is the difference between
resumable flag on or off. It just specifies how many bytes to read. How
will the browser actually resume download ?? My guess to the second
question is that the secret lies in how many bytes read. If resumable is
on, then less bytes will be read at a time and so if the user pauses
download, then the fseek will tell the last position till data has been
read. But with reading large bytes at a time, the problem is that if
paused, you again have to read the whole data.On Tue, Aug 13, 2013 at 5:42 AM, AbiusX [email protected]
wrote:it shouldn't be
please fix and push
Notice: This message is digitally signed, its source and integrity are
verifiable.
If you mail client does not support S/MIME verification, it will
display a
file (smime.p7s), which includes the X.509 certificate and the
signature
body. Read more at Certified E-Mail with Comodo and Thunderbird in
AbiusX.comOn Mordad 22, 1392, at 4:38 AM, SvenRtbg [email protected]
wrote:Why "echof" near line 230?
echof(fread($f, $advanceBy)); //read the specified number of bytes.
—
Reply to this email directly or view it on GitHub.—
Reply to this email directly or view it on GitHub<
https://github.com/OWASP/phpsec/issues/60#issuecomment-22535336>
.Regards,
Rahul Chaudhary
Ph - 412-519-9634
—
Reply to this email directly or view it on GitHub.—
Reply to this email directly or view it on GitHubhttps://github.com//issues/60#issuecomment-22549139
.Regards,
Rahul Chaudhary
Ph - 412-519-9634
—
Reply to this email directly or view it on GitHub.
from phpsec.
Related Issues (20)
- openssl_random_pseudo_bytes fails if openssl in not available HOT 2
- Flag 'suspicious' activity, with configurable threshold for reaction
- Coding Convention contradicts itself. HOT 3
- confidentialString function uses hard-coded key HOT 108
- PROJECT NEEDS TO BE SLATED AS INACTIVE HOT 3
- [SECURITY] phpsec/random.php - CSPRNG isn't used when available
- [SECURITY] phpsec/random.php - CSPRNG isn't properly error checked
- [SECURITY] phpsec/random.php - mcrypt isn't properly error checked
- [SECURITY] phpsec/random.php - Fallback CSPRNG is not CSPRNG
- [SECURITY] phpsec/user.php - Timing attack on hash comparison
- [SECURITY] phpsec/user.php - Passwords converted to lower case before hashing
- [SECURITY] phpsec user system XSS
- update for phpsec.owasp.org? HOT 39
- Question : Session HOT 3
- doubt about error handling in session library HOT 2
- mail injection prevention HOT 1
- Binding ip address with session HOT 12
- brute force detection for time based bots HOT 3
- Modification in Rand::randstr() function required HOT 5
- Trailing whitespaces issue HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from phpsec.