Freek.dev

Mohamed Said created a package that saves all mails sent out by a Laravel application to html files on disk. This can be incredibly useful when designing and debugging mails. It's implemented as a Laravel mail driver. Once installed you'll only have to change your driver to preview.

Take a look at the package on GitHub.

Read more

Glide is an easy to use image manipulation library by Jonathan Reinink. It was bumped to version 1.0.0 a few days ago. Glide can created optimized images on the fly by levering url's such as /img/users/1.jpg?w=300&h=400&fit=crop. Take a look at the example in the Glide documentation to know more.

I think Glide provides a very nice API to create image manipulations. Unfortunately it isn't very easy to use the API to generate an image using code. So I created a little package for that called laravel-glide. All new major versions of Spatie packages will require PHP 7, laravel-glide is no exception to this.

Here's an example of how to create a greyscale version image with a maximum width of 50 pixels.

GlideImage::create($pathToImage)
    ->modify(['filt'=>'greyscale', 'w'=> 50])
    ->save($pathToWhereToSaveTheManipulatedImage);

Take a look at Glide's image API to see which parameters you can pass to the modify-method.

Read more

One of the main questions when doing a major release is which minimum PHP version to support going forward. Last summer I decided I wanted to do a big jump from 5.3 and directly target PHP 7. It provides a lot of nice features as well as performance improvements, and as Monolog is one of the most installed packages on Packagist I wanted to help nudge everyone towards PHP 7.

Read more

Climb checks your composer files to see which packages are outdated, regardless of your version constraints. Without Climb, there's no way of knowing if a package has a new major release unless you use a notification system like Gemnasium. Climb is one of those tools you just need to get on your tool belt.

Read more

Jens Segers explains how to use PHP League's shiny new version of Container. The usage of ContainerInterface seems interesting:

League's container now implements the `ContainerInterface`, which is defined by the Container Interoperability group. This is really great as there are a few projects and frameworks which support this interface. For example, the Slim 3 micro framework already allows you to choose your own container flavour, as long as it implements the interface.

The League's Container seems like a nice alternative to PHP DI that I have been using.

Read more

The project I'm currently working on will have to send out mails to all its users on a regular basis. It's not a newsletter: the contents of each mail will be very specific to each user. The mail also should contain a link to unsubscribe the user from simular future mails.

The link could look like this: https://myapp.com/unsubscribe. Clicking on the link would direct the user to a login page. After the user has logged in the unsubscribe can be automatically performed. In my mind requiring the user to login first in order to unsubscribe from something isn't very user friendly.

This can be improved by adding the id of the user to the link. Here's what that could look like: https://myapp.com/user/1/unsubscribe. With this link you the app can unsubscribe the user with id 1 in one go. That'll work, but it's not very secure. Unsubscribe links for all other users can be easily guessed. Such links can be made more secure by adding a signature and an expiry date on them.

My colleague Sebastian coded up a Laravel package to create signed url's with a limited lifetime. Here's example where the url gets signed and made valid for only one day:

echo UrlSigner::sign('https://myapp.com/user/1/unsubscribe', 1);

This outputs an url that looks like: https://myapp.com/user/1/unsubscribe?expires=1123690544&signature=93e02326d75

The validate-method can be used the determine if a signed url is (still) valid:

$isValidUrl = UrlSigner::validate($theSignedUrlInTheExampleAbove);

The signature is calculated using the original url itself, the expiration date and a secret string that's specific to your project. When a malicious user tries to change any part of the url the signature won't match up.

I'm assuming that the most common use case of signing url's is to protect routes. The package supplies a middleware that protects routes from invalid signed url's. In the following example only requests with a valid signed url will hit the controller:

Route::get('unsubscribe', ['middleware' => 'signedurl', 'uses => 'UserController@unsubscribe']);

If you're interested in using the package, take a look at it on GitHub: https://github.com/spatie/laravel-url-signer

There's also a framework agnostic version: https://github.com/spatie/url-signer

E-mails can be intercepted and are never 100% secure. Bearing that fact in mind you should never use this kind of link for any destructive action.

EDIT: Some fellow developers pointed out that I could also obfuscate the id in the url. Here are two good libraries to do that:

• http://hashids.org/
• https://github.com/jenssegers/optimus

And sure enough, the unsubscribe links of other users cannot be easily guessed. A small downside however is that the url becomes less readable. The big disadvantage is that the url will remain valid forever. As these links through an unsafe medium I think it's a good idea to give them a limited lifetime. Signing an url will do that.

Read more