“WordPress Configuration Cheat Sheet” is a collection of about 10 tips for a more secure WordPress configuration file. Obviously, not all of them can always be applied, but it’s a good idea to review your own settings once in a while and to disable unnecessary bits.
Tag: best practices
Show outdated composer packages
A while back I shared a way to show outdated composer packages. Today, I want to expand on it a little bit. Thanks to this tweet:
https://twitter.com/waltertamboer/status/1059567319725301762
I think it’s slightly easy to remember with “composer show -molD -strict” (“old”, “mold”). Adding this to the test suite is a great tip too!
For other ways to show the outdated packages (using composer plugins), have a look at this StackOverflow thread.
Go Monorepo
As a maintainer and contributor to multiple, and often related, git repositories, I often find myself thinking that there must be a simpler way.
Consider, for example, a variety of CakePHP plugins that we develop and maintain at work. Sure, each one provides a completely separate bit of functionality and has its purpose as a standalone project. But, at the same time, they all have enough overlap that we use a common cakephp-plugin-template repository to keep things in sync, and also require cakephp-utils plugin from all of them.
It’s only natural to consider other ways of doing things. Sure, I tried git submodules before, but they don’t quite cut it. Something is still missing.
Today I came across the Go Monorepo website. Which makes me wonder even further down this road. There are also a few other tools and alternatives mentioned in this article.
That’s not something that I’ll jump into right now, but it’s definitely something I’ll consider to try out in the nearest future.
The Land Where PHP Uses eval()
“The Land Where PHP Uses eval()” is an interesting post powered by the study of 2,000 Open Source PHP projects. It details a number of scenarios where developers have used the eval() function and suggests the better ways for most of these. Despite of how dangerous and inefficient the eval() is in PHP, there are still good reasons to use it in some cases. Read the full post to see which are those.
Documenting lists with Swagger
Swagger is a great tool for documenting APIs. Not only it helps with keeping the documentation complete and up-to-date, but it also provides a handy sandbox for developers to play around with the API directly from the documentation.
We use Swagger a lot at work. We’ve even pushed the bar slightly, but automatically generating the API documentation on the fly, to match the rest of our Qobrix functionality. Whenever you change the database schema or the configuration of the fields, the changes are also reflected immediately in the API documentation. And it works great!
One of the things that we haven’t done though until very recently is the documentation of the list fields. Swagger provides the enum to document the values that can go into the field, but it’s not very helpful, when the values are not obvious. Country codes and currency symbols work well, as they are common knowledge. But if you have something custom, there needs to be a set of labels associated with the set of values.
The other day we decided that something is better than nothing, and added the documentation of the values as part of the field description (the property is described on the same page as enum above). Here’s the Pull Request with the tiniest of changes. And here’s how it looks in Swagger:
I admit, it’s not the prettiest of things, but at least the hints for the developers are there. Also, since the list of labels uses a specific format, it’s quite easy to parse it out of the Swagger JSON automatically and reuse in third-party applications and services (like a website, connected to the system via the API).
While browsing around, I’ve also noticed that Swagger is growing and expanding. There is a new version of the specification – version 3.0, which has also been re-branded as OpenAPI Specification (see OpenAPI Initiative). Here’s a great blog post that describes the differences between this and the previous versions, and here’s the migration guide for those who need it.
If you are working with PHP, zircote/swagger-php is the way to go. It already even support the version 3.0. If you are using the CakePHP framework, alt3/cakephp-swagger is the plugin for you (version 3.0 is not yet supported, but I’m sure it’ll get there soon).