Freek.dev

In a Laravel app most sensitive configuration values, like a db password, are being saved in an .env file. This file usually does not get committed in a git repo. In this way you can share the repo with collaborators without having them to know the sensitive values of your production environment.

The keys of the .env are often saved in an .env.example file that is saved in the repo. This helps you and your collaborators get up to speed quickly when installing the app locally. They can immediately see which environment variables are needed to run the app.

Over time however you might add a variable to .env and forgetting to add it to .env.example. It's a mistake that is easily made, and I have made that mistake many times in the past (sorry co-workers).

A couple of days ago Julien Tant released laravel-env-sync. This package makes sure the .env file is in sync with .env.example. After having installed the package you can run this artisan command to perform the sync:

php artisan env:sync

Thanks Julien for that awesome little package.

Read more

Laravel-Mediable is a package to upload and handle all sorts of files (aka media) in a Laravel app. It was built by a Canadian based web agency called Plank.

With it you can do things like this:

$media = MediaUploader::fromSource($request->file('thumb'))
    ->toDestination('uploads', 'post/thumbnails')
    ->upload();

$post = Post::create($this->request->input());
$post->attachMedia($media, ['thumbnail']);

Pretty cool. You can read more on the way and how the package was built in an introductory post on the Plank blog.

At Spatie we've also built our own solution for handling media. In Plank's blogpost Sean lists these differences between their package and our Medialibrary.

Since our medialibary was introduced I've been asked from time to time why our medialibrary uses a many-to-one polymorphic relationship. The answer is: simplicity.

A previous iteration of our Blender CMS (a version that used Zend Framework 1 instead of Laravel ?) had a screen where the user could pick a file from all uploaded files (it looked much like this wordpress screen). We saw that, after having set up a lot of sites with Blender, that almost none of our clients used that screen...

In our projects we also see that our clients mostly need to attach an image, or a pdf or whatever, ... to only one model (for instance a news item). It rarely happens that a client wants to attach the same file to different models.

In our code we want to handle that use case as simple as possible and that's why we preferred using a many-to-one relation over a many-to-many relation. All the other differences listed in Plank's post are caused by the same reasoning, we preferred simplicity and ease of use over flexibility.

If you're looking for a good solution to handle media in a Laravel app I suggest you take a look at both our Medialibrary and Plank's Mediable package. Both packages are good at what they do. Pick the one that best fits your project (and just feels good to you).

Read more

With vanilla PHP it's possible to check of if the SSL certificate of a given site is valid. But it's kinda madness to do it. Let's look at the code required:

<br />// Step 1: downloading the certificate from the site
$streamContext = stream_context_create([
    'ssl' => [
        'capture_peer_cert' => true,
    ],
]);

$client = stream_socket_client(
    "ssl://spatie.be:443",
    $errorNumber,
    $errorDescription,
    $timeout,
    STREAM_CLIENT_CONNECT,
    $streamContext);

$response = stream_context_get_params($client);

$certificateProperties = openssl_x509_parse($response['options']['ssl']['peer_certificate']);

// Step 2: parsing the certificate

/*
* I'm not even going to type out the further code needed.
*
* `$certificateProperties` has two keys `validFrom_time_t` and `validTo_time_t`. 
* Those keys contain the UTC representation of the date.
* You will need to check if the current date is between those dates.
*/ 

What. The. Actual. F. Let's fix this!

We've released a new package named spatie/ssl-certificate that makes checking the SSL certificate of a site laughably easy. Let's take a look at the code:

$certificate = SslCertificate::createForHostName('spatie.be');
$certificate->isValid(); // returns true if the certificate is currently valid

Boom, done.

The package has a few more methods that makes working with an SSL certificate a breeze:

$certificate->getIssuer(); // returns "Let's Encrypt Authority X3"

$certificate->getDomain(); // returns "spatie.be"

//A certificate can cover multiple (sub)domains. Here's how to get them.
$certificate->getAdditionalDomains(); // returns ["spatie.be", "www.spatie.be]

$this->certificate->validFromDate(); // returns an instance of Carbon

$certificate->getExpirationDate(); // returns an instance of Carbon

You can also use isValid to determine if a given domain is covered by the certificate. Of course it'll keep checking if the current datetime is between validFromDate and expirationDate.

$this->certificate->isValid('spatie.be'); // returns true
$this->certificate->isValid('laravel.com'); // returns false

The source code of the package is available on GitHub. My company has made many more PHP framework agnostic, Laravel and JavaScript packages in the past. Take a look at the open source page at our site to see if we've made anything that could be of use to you.

Read more

All sites owned by EU citizens or targeted towards EU citizens must comply to a crazy EU law. This law requires a dialog to be displayed to inform the users of your websites how cookies are being used. You can read more info on the legislation on the site of the European Commission. The newest Laravel package made by my colleagues at Spatie and myself makes your app compliant with that law.

Once installed the package will render the following dialog that, when styled, will look very much like this one:

When the user clicks "Allow cookies" a laravel_cookie_consent cookie will be set and the dialog will be removed from the DOM. On the next request Laravel will notice that the laravel_cookie_consent has been set and will not display the dialog again.

We've made it easy to customize the texts shown by the dialog. You can also make changes to the dialog or JavaScript itself.

The legislation is pretty very vague on how to display the warning, which texts are necessary, and what options you need to provide. This package will go a long way towards compliance, but if you want to be 100% sure that your website is ok, you should consult a legal expert.

Take a look at the package on GitHub to learn how to install the package and which options it provides. If you like it, be sure to check out our full list of Laravel packages.

Read more