I’ve updated my Flexible Logger to version 4. Changes for this version are:

* split plugins into individual files
* change error() to addError() to allow for a $logger->error(‘message’) method
* rename underscored properties
* better conformation to PSR standards
* more inline documentation

As usual you can clone the source from my GitHub repo

Yesterday I received a phishing email with an HTML attachment. The HTML contained a form containing banking details which would be POSTed to a particular URL. (eg: http://somedodgysite.com/carddetails.php) After filling in the form with junk and posting it, I noticed that the response redirected my browser to a genuine banking page.

I reported the site to several phishing alert sites and was quite surprised to receive a few responses that basically said “URL not accepted – this URL redirects to a non-phishing site”.

What?

That logic makes it impossible to block dodgy target URLs. A phisher merely needs to redirect to a genuine banking URL to have their page whitelisted. There are two simple things that can be done to avoid this:

• Security sites should allow a reporter to include further information when reporting the URL. Some do but even the mighty Google give you just a small text box to add a few lines of info to your report
  
  
• Security sites should not automatically assume a URL is safe if it redirects to a genuine site. If several reports are made about the same URL then it should be considered bad with an option for the URL owner to appeal – much like an SMTP RBL

Are there other ways this “malicious URL” reporting could be improved?

I’ve made my Stash classes (a lightweight ORM / DBAL of sorts) available for download. The simplest way to explain how they work is through some example code:

 
/*
 * first install the database using the example.sql file that comes with this package
 */
 
define('DSN_STASH_TEST', 'mysql://test:test@localhost/stash_test');
 
require_once 'opensourceame.stash.php';
 
/*
 * This is the singular class for person objects
 */
class person extends stash_bean
{
	protected	$_stash_dsn 		= DSN_STASH_TEST;
	protected	$_stash_table		= 'people';
	protected	$_stash_fields		= array('id', 'first_name', 'last_name');
 
	public function name()
	{
		return $this->last_name.', '.$this->first_name;
	}
}
 
/*
 * This defines the class people as a collection of persons
 */
class people extends stash_collection
{
	protected	$_object_class		= 'person';	
}
 
/*
 * EXAMPLE: fetch an existing person and display the name
 */
 
$person = new person;
$person->retrieve('20fee9bd-5f4d-d34b-5605-4cefaaca32ab');
 
echo $person->name()."\n";
 
/*
 * EXAMPLE: save an archive of the existing record
 * then change the first name from "Will" to "William" and update the record
 */
 
$person->archive();
 
$person->first_name	= 'William';
$person->update();
 
 
/*
 * EXAMPLE: fetching multiple person objects as a collection
 */
$people = new people;
$people->add_condition("and last_name='Smith'");
$people->add_condition("or first_name='Helen'");
$people->retrieve();
 
foreach($people->collection() as $person)
{
	echo $person->name()."\n";
}