symfony framework forum

by **El Riiico** » Wed Jun 24, 2009 4:28 pm

@Ases Only power users use Xdebug. These ones should know that it shouldn't be installed on the production server.

by **benhaines** » Wed Jul 08, 2009 12:21 pm

I suggest you add 'checklist' to the meta keywords. I'm no SEO expert, but searching google for 'symfony checklist' brings up my blog

~

~

[url=http://www.google.com/search?q=symfony+checklist&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-GB

fficial&client=firefox-a]http://www.google.com/search?q=symfony+checklist&ie=utf- 8&oe=utf-8&aq=t&rls=org.mozilla:en-GB

fficial&a mp;client=firefox-a[/url]

I posted a blog entry about this great idea a while back and it seems to have stuck. My logs also show me I'm getting 35+ hits a day from google using these search terms.

by **El Riiico** » Wed Jul 08, 2009 1:13 pm

Done.

by **gouiggou** » Thu Jul 16, 2009 10:48 am

Just a little typo :

Code: Select all: <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<php echo $sf_user->getCulture() ?>"↵ lang="<php echo $sf_user->getCulture() ?>">

become :

Code: Select all: <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<?php echo $sf_user->getCulture() ?>"↵ lang="<?php echo $sf_user->getCulture() ?>">

by **El Riiico** » Thu Jul 16, 2009 10:56 am

It's fixed, thanks gouiggou

by **gouiggou** » Thu Jul 16, 2009 11:00 am

And a little optimisation for apache.

Avoid htaccess. Put it into virtual host configuration, and then tell apache to not read htaccess on each request !

Code: Select all: <VirtualHost *:80> ... <Directory "/monprojet/web"> Options FollowSymLinks ExecCGI AllowOverride None Allow from All RewriteEngine On # uncomment the following line, if you are having trouble # getting no_script_name to work #RewriteBase / # we skip all files with .something #RewriteCond %{REQUEST_URI} \..+$ #RewriteCond %{REQUEST_URI} !\.html$ #RewriteRule .* - [L] # we check if the .html version is here (caching) RewriteRule ^$ index.html [QSA] RewriteRule ^([^.]+)$ $1.html [QSA] RewriteCond %{REQUEST_FILENAME} !-f # no, so we redirect to our front web controller RewriteRule ^(.*)$ index.php [QSA,L] </Directory> Alias /sf /var/www/common/symfony-1.2/data/web/sf <Directory "/var/www/common/symfony-1.2/data/web/sf"> AllowOverride None Allow from All </Directory> ... </VirtualHost>

by **El Riiico** » Thu Jul 16, 2009 11:23 am

The tip doesn't work on shared hosting environment, but it's definitively interesting on dedicated servers.

I'll test it and add it to the site with the "performance" tag.
As I'm very busy these days, it probably won't be before next week.

I may also add a small popup with the contributors list. Can I add your name to it, Jérôme Macias?

by **gouiggou** » Thu Jul 16, 2009 2:47 pm

Eric, you can add my name.

by **El Riiico** » Mon Jul 20, 2009 2:52 pm

I've added gouiggou's tip.

Optimize Apache: avoid .htaccess

As usual, typos and error reports are welcome.

by **COil** » Tue Sep 01, 2009 5:50 pm

I don't know if it was said before, but it would be really great to have a cookie that remembers witch checkbox are checked... With an init button to uncheck all once you have finished the check list for one project.

Thanks for the site, very usefull and easy to use.

by **SonicM** » Sun Oct 11, 2009 9:29 pm

In the askeet or the jobeet tutorial there is an introdution to svn. I don´t want to miss that feature, but it is important, that you delete the ".svn" folders, or at least deny the access.
With apache it is simple, you only have to put the following in the apache2.conf

Code: Select all: <Directory ~ '*\.svn'> Order Allow,Deny Deny from All </Directory>

The other possibility is to deploy the code with svn export, but this takes some time and I like "svn update" for fast debugging

~

~

The files that are accessable from the web, such as the frontend.php are not that important, but I think you should remember the developer on your site.

by **El Riiico** » Mon Oct 12, 2009 7:10 am

The symfony standard way to export a project to production is to use the "php symfony project:deploy" tool.

During deployment, the files listed in "myproject/config/rsync_exclude.txt" are ignored. As ".svn" is set by default in rsync_exclude.txt, the sf users just don't have to deal with this issue by default.

I'm not sure to understand well what you mean about "frontend.php", but files like "frontend_dev.php" shall not be available on the production server.

by **SonicM** » Mon Oct 12, 2009 9:22 am

Deployment is the first step. But in most cases you have to update the site, be it bugs or new wishes. In this case I use svn update and delete then the *_dev.php files. But the problem are the files in the subdirectory ".svn". You can see all the files in the directory and if the webserver deliver .svn-base compiled, you can see anything like that: http://www.gutefrage.net/.svn/text-base/error.php.svn-base but if not, the file is readable.

I don´t think that it is a very big security problem, but everyone has the possibility to see what your directory structure is and which files you use. By the way, if you use svn to deliver the updated files to the webserver (svn update) the *_dev.php needn´t to be there to be read. see this link http://www.gutefrage.net/.svn/text-base/frontend_dev.php.svn -base
In this case the file is executed, so that none could read the content, but in other cases you can read it.

Like I said, it is not such a big security problem, but it is worth to remark it.
How do other symfony users update their projects? I mean debugging or adding new wishes for the customer? With svn export?

by **El Riiico** » Mon Oct 12, 2009 9:45 am

I insist, symfony deployment system uses Rsync, you could (should ?) use project :deploy not only for the initial commit, but also to deploy the modifications.

Here is a quote from the related sf documentation :

With incremental transfer, only the modified data will be sent. If a file didn't change, it won't be sent to the host. If a file changed only partially, just the differential will be sent. The major advantage is that rsync synchronizations transfer only a small amount of data and are very fast.

You can check all the deployment options in your terminal :

Code: Select all: php symfony h project :deploy

Of course you can use subversion for your deployments.
Subversion is a great powerful tool, but as using it for deployments doesn't follow symfony practices, so I won't add your advice to symfony-check, sorry

~

~

by **alecs** » Sat Oct 17, 2009 11:45 pm

maye it is, maybe is not the place where we could put a hit on how we can deploy the symfony project in a shared hosting. i guess the simple method is by creating a folder and upload in ityour sf project on your server (preferably not in public_html) andd then edit 3-4 files

in config/projectConfiguration... to add a like like $this->setWebdir('/path/to/your/public_html/'); in your configure method

edit the web/*.php and change the require path like
require dirname(__FILE__).'/../sf_project/(and the rest here, without ../ )';

I have gave the example assuming that i have /home/alecs/sf_project/ folder and the www folder is placed in /home/alecs/public_html/

I will come with a functional example tommorow

by **weaverryan** » Sun Oct 25, 2009 2:35 pm

Absolutely love the site - well done and well executed.

Going through it this morning in some details and found a few quick "typos".

<ol type="1">
<li>'Customize the "Login Required" Page': About half-way down, there is a header that says "Display the error page to test it". I think that's just copied from the previous item - should be "Display the login page to test it". The next section. 'Customize the "Credentials Required" page' suffers from this same problem.
<li>Right below that, ordered list item #2, "preferencies" should be "preferences".
<li>'Customize the "This Module is Unavailable" page' - First paragraph, "default/login" should be "default/disabled"
</ol>
If I find any more, I'll post them. The site has been a great resource for us - glad to see everyone is pitching in.

Also, someone mentioned putting "checklist" in the meta tags. I thought you had put it in there, but I don't see it now. I'd throw "checklist" in both the meta tags and the title tag - when I google it, I get a blog about it.

Thanks!

by **weaverryan** » Sun Oct 25, 2009 3:58 pm

Hey guys-

A few other tiny details:

Code: Select all: - 'Delete "/backend.php/" from your uri' - "Personnaly" should be "Personally" - 'Optimize Apache: avoid .htaccess' - "dealed" in first paragraph isn't a word - not sure what it should be. - "can't be cached apache" should be "can't be cached by apache" - "the server has to scann the" should be "the server has to scan the" - "If you moving the .htaccess rules to your virtual host configuration file, the rules will be put in cache and apache performances will be improved." should be "If you move the .htaccess rules to your virtual host configuration file, the rules will be cached and apache performance will improve." - "apache configuration files on virtual host environments" should be "apache configuration files on shared hosts" - Hmm, not sure about this: "Most often, you'll find the virtual host configurations in the bottom of the httpd.conf, but sometimes, they are moved in some vhosts.conf file." Apache 2 places vhosts in a sites-available directory inside /etc/apache2 - "Unless If you added extra rules in it, the file is now useless." should be "Unless you added extra rules in it, the file is now useless." - "but it could be on your configuration." - not sure what this means, does it mean that it could be in your executable "path"? - "Your project really should have at least a README file where this kind to modifications are reported." should be "Your project really should have at least one README file where these kinds of modifications are reported." - the final 2 paragraphs have pretty sloppy english

Thanks! As I said before, it's great, which is the only reason I care about the wording!

by **El Riiico** » Sun Oct 25, 2009 6:44 pm

Weaverryan, thanks you for your support on symfony-check, I've fixed the typos you kindly reported.

And thank you for thatsquality, your articles about symfony and the Amazon services are really great !

by **Ninj** » Fri Dec 04, 2009 4:30 am

Hi, a big thanks for your sheet, which is already in my bookmarks

~

~

This page of the symfony doc shows some tips in the frame named "Is your application finished?":

http://www.symfony-project.org/book/1_2/16-Application-Manag ement-Tools#chapter_16_sub_using_rsync_for_incremental_file_ transfer
(just check at the end of this 'Using rsync for..." sub-chapter)

Most of them are shown on your sheet, but i see for example the robots.txt being a really itneresting final touch to a website, and i did not find read anything about it on your sheet.

by **El Riiico** » Fri Dec 04, 2009 9:18 am

Thanks Ninj, I'll try to add it before the end of the year.

I also plan to update some tips for sf 1.3/1.4.

by **j4cKiE** » Mon Jan 11, 2010 2:31 pm

Great list, thanks for sharing!

by **forkmantis** » Thu Jan 21, 2010 6:46 pm

Your site is excellent. Thanks for sharing. I find it odd, though, that you do not have a favicon

~

~

by **lacyrhoades** » Tue Feb 02, 2010 6:36 pm

for consideration:

http://groups.google.com/group/symfony-devs/browse_thread/th read/7ef9104bd36e834a

remove execution of server side code in the upload area

by **El Riiico** » Tue Feb 02, 2010 6:48 pm

Thanks lacyrhoades, I know, I'm Éric Rogé, I reported the vulnerability.

I plan to add a new todo point about it the sooner I can.

by **j4cKiE** » Tue Feb 02, 2010 7:05 pm

Great! Let us know, when the new point is released.

~

~

Besides, I'd like to see even more ToDo-Points that improve my symfony projects. :oops:

by **El Riiico** » Tue Feb 02, 2010 7:13 pm

I'll have more time for evolutions on Symfony check later this month.

New todo points and new features proposals are welcome.

by **El Riiico** » Mon Feb 08, 2010 9:18 pm

I've added a new todo about the way to secure the file uploads.

by **oweitman** » Wed Apr 07, 2010 9:27 pm

atodo i ran into:
after i setup my site i checked google for the index of my site.
i saw that the pages-links are indexed with an session-id like http://www.url.com/?symfony=1234567abcdefg

after i searched in the forum i found the following advice:
http://forum.symfony-project.org/index.php/m/36201/?srch=ses sion+google#msg_num_9

to set the session handler for url off and to remove the wrong indexed pages from search-engines

by **tinynumbers** » Sun Apr 11, 2010 4:49 pm

Under "Fix Your Deployments" you say...

Production database must be protected

You really should add theses files to rsync_exclude.txt :

/config/databases.yml
/data/sql/schema.sql

... which implies that you shouldn't transfer databases.yml over to the production server. But without that file, how will the production server know the dsn/username/password for the database?

by **Ninj** » Sun Apr 11, 2010 4:58 pm

I may have got it wrong, but when a file contains server-specific data, it should not be versionned. This could cause an svn-update on the server to erase connection parameter for example.

That makes me think that it's a good practice to completely separate and isolate server-specific data from the shared information.

Typically, databases.yml holds both server-specific parameters and project-wide data, which leads to this situation where a file that cannot be versionned needs to be updated by hand in case of strucutral changes.

by **El Riiico** » Sun Apr 11, 2010 5:23 pm

I fully agree with Ninj, that's also the reason why I suggest to exclude databases configuration files from deployments.

Tinynumbers : of course the production server will need these files.
"databases.yml" should be added by hand after the very first deployment and then you should generate "schema.sql" thanks to the the "symfony doctrine:build-sql" command.

by **tinynumbers** » Sun Apr 11, 2010 5:57 pm

Ninj wrote: I may have got it wrong, but when a file contains server-specific data, it should not be versionned. This could cause an svn-update on the server to erase connection parameter for example.

That makes me think that it's a good practice to completely separate and isolate server-specific data from the shared information.

Typically, databases.yml holds both server-specific parameters and project-wide data, which leads to this situation where a file that cannot be versionned needs to be updated by hand in case of strucutral changes.

But my understanding (and the way I'm working, using Symfony 1.4) is that databases.yml contains different configuration sections for the different environments (dev, test, prod, etc) all within the same file, but under different environment names, so there's no chance that database configuration changes to one environment will mess up a different environment.

That's why I wondered about this.

I currently keep everything in SVN, and when doing a deployment on the production server, it just consists of three commands:

Code: Select all: svn update ./symfony project:clear-controllers ./symfony cc

Works fine for me.

by **Ninj** » Sun Apr 11, 2010 6:54 pm

Ok, I understand that you're using environments to hold parameters of different servers (your local server in "dev", you remote production server in "prod"...)

Well, that's not really the purpose of environments. They exists so that you can easily manage a dev and a prod version on a server, for instance. But I guess there's nothing wrong in doing as you do.

In your case (databases.yml holds parameters for both the prod server and your local install), you can version it.

Hope that helped!

by **tinynumbers** » Sun Apr 11, 2010 6:57 pm

Ahhhh... yes I'm beginning to understand now. Since my "dev" environment sits on a "dev" server, and my "prod" environment sits on a "prod" server, I'm using the notions of "environment" and "server" synonymously / interchangeably. I certainly can see cases where that would not be how things are handled.

Thanks for the clarification.

by **Ninj** » Sun Apr 11, 2010 7:17 pm

Exactly, you got it

~

~

With the exception that, personally, I mostly see cases where that shouldn't be. Environments are here to be switched, i would say almost dynamically. You test your pages in DEV, and then to be sure it works, you use the PROD environment. And when you encounter an error in PROD, you go back to DEV to get details.

The principle behind environments are obvious: you shouldn't play with prod database when doing your tests

~

~

And tests are to be ran both locally and then on the remote server after svn update. You're never sure what works on your computer will work the same on a hosted server. That's where you see that you need a DEV environment in both your local and the remote versions.

Think of that: a user reports to you an error on your prod site. The first thing to do is to try to reproduce it. Then you switch to the DEV mode on your server (thus changing the DB used) and try to get more information. When you know what's happening, you come back on your computer, make changes, and commit it. On the server you update, test to see weither the bug is effectively gone, and you're done!

Well, you could answer to me that, merging your approach and the usual one, a solution would be to create more environments : DEV & PROD for remote server, and LDEV & LPROD for local developpement. Why not? But that's up to you!

by **Flukey** » Mon May 31, 2010 3:35 pm

Hi there!

First of all Riico, the site is brilliant. Good work!

I am surprised that there is no mention about minifying your js and css files.

There is a good plugin (http://www.symfony-project.org/plugins/sfMinifyPlugin) which does a very good job of this.

Anyone else agree it would be good to have included? It certainly speeds up performance!

Once again, good work.

~

~

symfony framework forum

A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Re: A todo list to check if your application is finished !

Who is online