From the moment Sherlock leaves the reporter Kitty Riley’s house he says “There’s only one thing he needs to do to complete his game and that’s – “. He stops mid sentence, suddenly aware he has to commit suicide to stop Moriarty. From that point on my theory is he is planning his own fake death.

After that he visits Molly, and clearly engages her assistance in his plan. He then summons Watson to help him work out how to get Moriarty’s computer code. However, within a few minutes he seems to work out the whole binary code thing but keeps it from Watson. In fact he looks rather shifty towards Watson as if he’s hiding something. An external shot follows, and the night wears on.

In the next scene Watson looks exhausted after waking from sleeping at the desk and receives a call informing him Mrs Hudson has been shot. When he takes the call Sherlock again looks very shifty. It’s my theory Sherlock arranges that call to get Watson temporarily out of the way. Watson rather cuttingly says “friends protect people” in reply to Sherlock’s refusal to join him. Of course, Sherlock is doing this precisely in order to protect him.

Sherlock then meets Moriarty on the rooftop, in what is a superb verbal clash of two crazed geniuses. There are a few shots of the ground, where we see a clear rectangle drawn with what looks to be chalk on the pavement. This is Sherlock’s target.

After Sherlock seems to acquiesce to jumping he asks Moriarty for “a little privacy”. He briefly looks down and then laughs, I presume by this point the truck has parked next to the pavement marks, ready to put his plan into action.

After Moriarty’s shock suicide by gunshot Sherlock appears to panic. I don’t think Sherlock could have anticipated that. But it could also be to make it seem to those watching that he’s loosing it.

Watson arrives, the taxi setting down on the opposite side of the road. There are a few shots of a low building near the entrance to Barts which is in between Watson and the pavement where Sherlock falls. When Watson gets out of the taxi he directs him to a specific position, so he can’t see where he falls. That’s also why he later cries out to Watson “stay exactly where you are, don’t move”.

He talks on the phone for a while, presumably to ensure there are no pedestrians near when he falls. And of course, to try to convince Watson he really is the fake Moriarty wants everyone to believe.

When he does fall the street is totally empty. It is very early in the morning, and two buses picked up all the waiting passengers. And I think it is Sherlock that falls – from the scene that much seems obvious. Presumably he lands on something that breaks his fall (provided by the driver of the van) and most likely swaps his body with a relatively fresh cadaver in his clothes.

At this point Watson’s view is obstructed by both the building in front of him and the van. And as soon as he runs to Sherlock he’s violently knocked to the ground by a cyclist – who promptly flees the scene.

The van next to the chalk rectangle suspiciously leaves very shortly after Sherlock falls. My guess is with Sherlock inside and driven by Molly. The body on the pavement is lying sideways and just outside of the chalk rectangle. Possibly because the body was just thrown out of the van?

So I think Sherlock knew he had to jump before he got there and he’d laid out an elaborate plan to fake his own death. This must have required the help of Molly (who helpfully works in a mortuary) and at least one other (the cyclist). It all seems very clever, and Sherlock had to keep the secret for months afterwards to ensure the assassins really were called off.

I wonder if the above is right, I guess I’ll just have to wait until series 3, whenever that will be…

Best line.. Sherlock: You’re insane. Moriarty: You’re just getting that now!

• Photography – I have a great Canon 40D camera which apart from a fabulous trip to New York City has been unloved in the past year. I want to photograph more in 2012, starting with my attempt at the 365 project over on Flickr
• Writing – I also love writing, when I give myself the time to do so. I intend to write more in 2012 and will try to get my writing published elsewhere than just my own blog.
• Family – With Daniel almost 2 and Billy 4, our two boys are becoming very interesting little people. It goes without saying the next year will be full of lots of family time, but it doesn’t stop me making sure I remember it should be my focus.
• Cycling – I rarely cycle to work these days, even though the 4 mile journey is less stressful via bike than car (and takes about the same time). Really need to do this more to offset the beer and pies

Let’s see how I do in a few months time!..

Take a look at http://www.studio24.net/blog/taming-mamp-on-the-command-line-pear

In fact, it’s a clickjacking exploit that contains a hidden form which submits a public comment on your Facebook account with a link back to this site. I first came across clickjacking exploits on Chris Shiflett’s blog, it’s a cunning method of hiding a real form within an iframe behind something like an image that usually has something clickable on it. In this case it has a fake CAPTCHA form whose fake form elements are lined up to submit the real Facebook status update form hidden in the iframe.

This exploit may be related to the daughter on webcam issue reported by Sophos or this might just be an example of very successful keywords used by scammers.

I see it’s been reported on Facebook’s security pages, I don’t know if it’s something Facebook can technically fix but I would hope they can ban links from this website to avoid users inadvertently spreading this exploit.

So if you’re a Facebook user don’t go clicking on links about daughters on webcams. Or any suspicious links for that matter. Always check URLs and if it looks dodgy, get out of there!

Just use this snippet of code in your controller to return a list of route names set up in your ZF application in the order they are matched via the routing system (i.e. the route at number 1 is matched first, then route 2, etc).

// Output list of routes, in the order they are matched
echo '<ol>';
$routes = array_reverse($this->getFrontController()->getRouter()->getRoutes());
foreach ($routes as $name => $route) {
    echo "	<li>$name</li>\n";
}
echo '</ol>';

Find out more about the ZF Router at the ZF manual.

Just drag this ZF Manual Index bookmark onto your browser bookmarks bar. Clicking the bookmark will add a contents index to the top of any Zend Framework manual page. Helpful links ahoy!

If you want to view the source code take a peek over here.

$front = $this->getFrontController();
$adminLayout = new My_Controller_Plugin_AdminLayout($this->_helper->layout());
$front->registerPlugin($adminLayout);

If you want to alter the plugin so it runs after any other local plugins you could specify a stack index of 10 as a second argument:

$front->registerPlugin($adminLayout, 10);

However, unless you know what the existing plugin stack indexes are it’s difficult to know what stack index you should be using. You can use this small code snippet to output the plugin name and its associated stack index, again via your controller.

foreach ($front->getPlugins() as $stackIndex => $plugin) {
    Zend_Debug::dump(get_class($plugin), $stackIndex);
}

The standard ZF plugin list should be something like:

99 string(36) "Zend_Layout_Controller_Plugin_Layout"
100 string(35) "Zend_Controller_Plugin_ErrorHandler"
999 string(33) "Zend_Wildfire_Channel_HttpHeaders"

Hope this helps shed light on a rather useful feature of ZF! You can find out more at this excellent Devzone article on Front Controller Plugins in Zend Framework.

Its main features are:

• Organise modules into sub-folders where you need to support a complex collection of controllers, views, models, etc
• Supports URLs in the format: /sub-module/module/controller/action
• Supports ID route: /sub-module/module/controller/action/id
• Registers controller folder to support above URLs
• Autoloads module resources (using Zend_Application_Module_Autoloader) in the format: submodulenameModulename_Resource (i.e. AdminUser_Form_Registration)

This supports URL routes such as:

www.domain.com/admin/user/ ->
application/admin-modules/user/controllers/IndexController.php

www.domain.com/cms/news ->
application/cms-modules/news/controllers/IndexController.php

It’s a bootstrap resource that can be enabled in your application.ini file as so:

; 'admin' key is the name of sub-module group = path to sub-modules directory
resources.subModules.admin.directory = APPLICATION_PATH "/admin-modules"

• Download S24_Application_Resource_Submodules
• View S24_Application_Resource_Submodules source code

The session was excellent, well worth attending, and dipped into many areas of ZF. Some of which I knew already, but there was certainly enough good tips on how to organise applications efficiently in ZF which I’ll be telling my team all about when I get back to the UK.

My notes from the tutorial day appear below, be warned they are rather long! You can also review the Zend Framework Workshop slides over at Slideshare.

Service layers

Think of the application as an onion layer. From the inside out:

• Data Access objects (inner layer)
• Data Mappers, Repositories, Transaction scripts
• Domain Models and Entities (plain old PHP objects)
• Service layer (outer layer: how will I interact with all this, the public API)

It’s better to have a rich domain model, validation in domain model.

• Start with a plain old PHP object
• Define schema based on objects you use
• Create objects first
• Create schema once models have been created and tested

Use mappers or transaction scripts to translate objects to data and back again.

Use Service Object to manipulate entities. Ie.

• fetchEntry()
• fetchComments()
• addComment(), etc

What’s in a Service Layer?

• Application specific logic
• Forms, validation, caching

All the bits and pieces of the app I don’t want to deal with when writing the front-end.

Q: Should we use services for everything?
A: Use for all parts of an app, easy to test

Rob added:

• he uses the form as the service layer
• uses a mapper class based on ZendDbTable
• compose the form in the service layer
• tend to put search indexing on mapper layer (postSave method)

ACL

ACL is roles, resources and rights (resource privileges). By default ACL operates as a whitelist (i.e. open up privileges to those you trust). Blacklisting is less secure, not recommended.

One approach is to extend Zend_Acl and set up roles and resources in constructor. Roles are simply text strings. Resources are much the same but have an array of privileges that can also be passed (i.e. read, write).

Suggested logic:

• Check ACL
• Check the role acting on a resource has a right to perform the action
• isAllowed() – checks role, resource, privilege

Matthew added:

• I like to throw a specific exception for failed ACLs so I can detect it
• I can then check for another exception case in the ErrorController to display a Not Authorised page (nice approach)

Paginators

• Return paginators from your domain models
• Consumers can specify offset and limit
• Zend_Paginator implements IteratorAggregate and toJson()
• Paginators have efficient, lazy loading

I.e. fetchAll() in domain model returns paginator

Zend_Application

• For common configuration & per-environment configuration
• Resource injection so you can use bootstrap as resource repository
• Resources: in bootstrap class or as a re-usable plugin resource
• Reusing for a service endpoint (i.e. set environment = jsonrpc)
• Dependency tracking
• Accessing resources via controller
• Module bootstrapping. Not particularly good at present. Runs all module bootstraps if exists. Order of running module/main app boostraps ambigious. Don’t mix resource names/application.ini key names in main app + module. Kathryn Reeve wrote a nice module bootstrapping solution.

Routing clinic

As an aside throughout the day Matthew and Rob have been using the syntax use Zend_Long_Class_Name as ShortName – nice way to alias class names in PHP 5.3

• Basics: Name the route, specify the path, specify default values and optional validation
• RegexRoute can support: 'blog/(?<id>[^.]*\+)\.(?<format>xml|json)'
• That regex route stores first param as ‘id’, 2nd as ‘format’ (that’s the handy ?<name> format)
• Regex routes are very fast, even more so in PHP 5.3
• Touched on hostname routing which you then need to chain with a normal route
• RESTful routes Zend via Zend_Rest_Route
• Can specify as default route, or add it for all controllers in a module
• Or set REST routes for specific module / controller / actions
• Controller then needs to extend ZendRestController (listAction, postAction, etc)
• ID is accessed via getParam(’id’)

Layout View Helpers

• You should always run output via the $this->escape() view helper! In ZF2 it will be default when you echo content
• Layout helpers: Set metadata, aggregate content, rendered in layout
• If you have CSS/JS related to a particular layout put it in your view script. Really important for maintenance.
• doctype() affects rendering of other view helpers, i.e. forms. Ideally needs to be set in bootstrap: resources.view.doctype = XHTML1_STRICT
• Head view helpers – can append and prepend content.
  • headMeta(), headTitle(), headScript(), headStyle(), headLink()
  • inlineStyle() – usually at top of body
  • inlineScript() – usually at bottom of body
• Use a layout helper if your functionality is shared across multiple view scripts to set all this common stuff
• Append and prepend helps give an order to things like how CSS files are loaded
• echo $this->baseUrl('path/to/file') will return BASE_URL . ‘path/to/file’ which is handy

Zend_Navigation

• Helps manage trees of pointers to web pages
• Supports HTML header links (i.e. next, previous, alt formats)
• Can generate XML Sitemaps (used by Google)
• Translate link text
• Conditionally display links based on ACL
• Two main concepts are pages and containers
• Page types: MVC (router based URLs), URI (static URLs)
• $page = Zend_Navigation_Page::factory(array('uri' => '/uri'))
• Containers implements RecursiveInterator (iterate entire tree) & Countable
• Pages are also a container, you can have trees of pages
• Add pages with $container->addPage()
• Can add multiple pages via addPages()
• You can remove pages based on index or order number
• Visibility and active page properties affect whether a page is rendered to the page
• Can find pages via methods like findOneBy(), findAllBy(), findOneByLabel()
• You can define your own metadata for pages. For example if you have a ‘tag’ property, find method for nav is findAllBy(’tag’, ‘value’) or findAllByTag(’value’)

• Rendering on the page:

  foreach ($container as $page) {
      echo $page->label;
  }

Cache your definitions

• On first request build programmatically and cache via toArray()
• On subsequent requests load from cached array
• Only use when you need it (i.e. not when doing JSON requests, service calls, etc)

Navigation view helpers

• $view->navigation()->setAcl($acl);
• $view->navigation()->setRole($role);
• Can set default ACL and default roles in your bootstrap. I’d suggest passing ACL from your controller into your view.
• Check for ACLs with hasAcl() & hasRole()
• echo $this->navigation()->htmlify($page);
• Renders link, uses label as title attribute

• Conditionally echo link

  if ($this->navigation()->accept($page)) {
      $this->navigation()->htmlify($page);
  }

• Note that other Nav view helpers are ACL-aware. I.e. echo $this->navigation()->sitemap()

• Sitemap specific metadata: lastmod, changefreq, priority
• Set priority of news list pages lower than news pages themselves, so Google deeplinks to article pages rather than news list pages
• Render breadcrumbs via $this->navigation()->breadcrumb()
• Useful configuration is setMaxDepth($depth) to avoid very long breadcrumbs
• echo $view->navigation()->menu()->renderSubMenu() – current active tree only
• Gotcha with breadcrumbs. If current page is hidden it won’t render breadcrumb

Caching

• Principle: Request from browser, is it cached? If so serve from cache, if not generate and save in cache
• Adapter based system. Front-end = what to cache, Back-end = where to cache
• Front-end options: set lifetime = null to cache forever (you then control when you empty the cache)
• Manually initialise cache in bootstrap. I.e. _initCache()

• Don’t do it that way! There is a better way! Use Zend_Cache_Manager (manage multiple caches)

  • Lazy loads on demand
  • Contains preconfigured caches
  • Application resource
  • Can use action helper to access it

resources.cachemanager.default.frontend.options.lifetime = "..."
backend.options.cachedir = APPLICATIONPATH ".."

‘default’ is name of cache. Make sure you use different keys for multiple caches.

Controller:

protected function _getCache()
{
   $bootstrap = $this->getInvokeArg('boostrap');
   return $bootstrap->getResource('cachemanager')->getCache('default');
}

// Helper
$cache = $this->_helper->getHelper('Cache')->getManager()->getCache('default');

• Zend_Cache_Page = full page caching – skip entire MVC stack
• Implement in index.php before config loading
• frontend options: ‘regexps’states which pages to enable page caching for. Not usually what you want for all pages on a site (i.e. dynamic content, forms for error validation, shopping baskets, etc)
• You can state cache everything apart from exceptions with regex rules

Some numbers to think about

• No caching: 12 trans/sec, cache DB: 29 trans/sec, cache page: 359 trans/sec

• With APC enabled: no caching: 19 trans/secs, cache db: 289 trans/sec, cache page: 3251 trans/sec

• Static page cache exists to store cache of HTML files to local document root. Amazing performance.

Context Switching

• Context switching is the act of providing different output based on criteria from the request
• I.e. XMLHttpRequest, REST, Mobile device
• WRFL – list of all mobile platforms and browser detection strings & capabilities
• Works via a ‘format’ parameter request. This can be set via:
  – Query param
  – Special route
  – Chained routes (’xml’, chain with a ‘.’ – i.e. controller/action.xml)
  – HTTP headers (Accept header)
• ContextSwitch action helper determines whether action has context matching the format
• Additional view suffix is added (i.e. viewscript.json.phtml, viewscript.xml.phtml)
• Keeps things explicit so you know where your code/views are

Add context switching to controller:

$contextSwitch = $this->_helper->getHelper('contextSwitch');
$contextSwitch->addActionContext('action', 'format')
              ->initContext();

Sitemaps and robots.txt

A neat example of context switching from Rob.

• Two static routes sitemap.xml & robots.txt
• Format values of ‘xml’ and ‘txt’
• Have to manually add context for txt (sets the correct Content-type header)
• View = sitemap.xml.phtml & robots.txt.phtml
• Can support HTML version of sitemap in sitemap.phtml
• So context switching changes Content-type and view script and uses same controller action
• Can do other stuff by getting param ‘format’

Header detection

• setHeader(’Vary’, ‘Accept’) – tells browser not to cache Accept header. Important!
• Set format based on accept header
• getHeader(’Accept’): application/json or application/xml
• To be honest I got lost around here. Will check out slides & Matthew’s blog later

Form Decorators

• Renders elements & forms
• Decorators stack from inside to outside
• The order of your decorators is the most important thing

Standard element decorators:

1. Zend_Form_Decorator_ViewHelper – renders input field
2. Zend_Form_Decorator_Errors – UL list of errors
3. Zend_Form_Decorator_Description – P description
4. Zend_Form_Decorator_HtmlTag – DL/DL tags

5. Zend_Form_Decorator_Label – field label

• The above happens in Zend_Form_Element::loadDefaultDecorators()
• Decorator itself states whether it wraps other elements or not
• Change this with: element->placement->prepend() – puts in front

Standard form decorators:

1. Zend_Form_Decorator_FormElements – form elements
2. Zend_Form_Decorator_HtmlTag – DL tag
3. Zend_Form_Decorator_Form – FORM tag

Common use cases to customise decorators:

• Change form element HTML (i.e. ul instead of dl)
  • Clear decorators and re-add them as you want them
• Change HTML outputted, i.e. parse form description using markdown
  • Extend Description decorator and alter output of description HTML

If you use your own decorator classes:

$form->addPrefixPath() – for Form class
$form->addElementPrefixPath() – for Form element & Validate classes

• Write your own decorators. Implement a render() method to return HTML. Extends Zend_Form_Decorator_Abstract
• render($content) accepts previously rendered content. You need to return the content you get in so you can wrap / append / prepend content – (that bit never made sense to me before!)
• Good idea to check the user defined separator & placement and alter output accordingly (otherwise you may break expected functionality)
• Sidenote: Rob uses simple App_ namespace for client website specific library files. Nice and straightforward
• Rob displays errors on form, not element. He removes errors on each element and puts a list at the top. This is achieved via a custom decorator called Form_Errors

Testing

• What do I test?
  • Domain models
  • Service layer objects
  • Integration testing (does your MVC generate the content you’re expecting?)

Testing MVC pages

• Extend Zend_Test_PHPUnit_ControllerTestCase
• setup() creates instance of Zend_Application
• assertions to match content. Uses CSS selectors aka jQuery (nice)
• also supports XPath expressions to match content
• redirect assertions
• response assertions (response codes, matching header content)
• request assertions (matching module, controller, action, route)

I.e. Assert a H1 heading exists: $this->assertQuery('#content h1')

Q&A

I quizzed Rob in the break on CMS style routing where all page URLs are stored in a database. He expanded on this in the Q&A session.

• MS_Controller_RouterRoutePostSlug (a slug = a URL fragment in good old WordPress terminology)
• implements Zend_Controller_Router_Route_Interface
• $router->addRoute(’postSlug’, new MSControllerRouterRoutePostSlug)
• Must implement 3 methods:
  • getInstance() – not used in Rob’s example, return new self(); neatly disables it
  • match() – must return array of module, controller, action. (This is totally undocumented in code or manual! Nice to see an example)
  • asemble() – creates a URL via url view helper. Usage may pass menu ID to create URL

match($path)

• method argument $path = URL path
• if return false, router falls through to next route
• Get slugs/URL fragments from DB in bootstrap & cache it for speed
• $slugs = array(URL => array(’module’, ‘controller’, ‘action’, ‘navigaton object’, ‘menu_id’) )
• custom keys accessed via $request->getParam(’menu_id’)

assemble($data = array(), etc)

• For normal routes you pass the module, controller, action, etc in via the $data array
• In this example you can put the following into the $data array: full url, page, menuId
• Returns URL string: output URL string . $this->_assembleRemainingParameters($data)
• That last bit is important if any custom params have been passed to assemble by the user

We all finished off with a stirring debate on how awful WSYIWYG editors are when someone asked how Rob convinces clients to use markdown.

• Rob just doesn’t give them a choice, doesn’t get many problems most clients OK (he is tech director so he can also decide within his company)
• Rob uses Markdown for clients (exactly what I used to markup all these notes!)
• If you allow HTML input from the user then don’t try to sanitize with ZendFilterStriptags. Use HTML Purifier instead which can be used to create whitelists. Pádraic Brady has blogged a lot about HTML Purifier

domain.com/user/register -> app/modules/user/RegisterController.php

While useful when we need to expand our URLs (and organisation of code) beyond one set of controllers, there are a few things they don’t currently solve which I think would make them first-class citizens within ZF.

I quite frequently find myself wanting some form of sub-modules, usually in admin systems where one “admin” module just doesn’t cut it for larger sites. Without modules we’re stuck with an AdminController.php which obviously gets very messy, very quickly. With modules, we can have an “admin” module with as many controllers as we wish. This is fine, until a site needs to manage lots of discrete elements.

For example, imagine a site with a CMS, user management system and a custom system to search for wines. While you could have a CmsController, UserController and WinesController in your “admin” module, it’s likely Cms and User would benefit from splitting out into multiple controllers of their own.

There’s also the issue of modularity. If I design a user management app which I want to re-use, it’s easier if I can install this into a folder (or SVN external it). If reusable components are mixed in the same folder they become harder to maintain and keep up to date.

In one attempt to solve this I created an Admin Modules bootstrap resource, which hijacks the domain.com/admin route and enables you to add admin modules to this URL.

To enable an admin module simply create a folder in your application folder called admin-modules. Within here simply place each module. Mapping works as follows:

domain.com/admin/
-> application/admin-modules/default/controllers/IndexController.php

domain.com/admin/user/
-> application/admin-modules/user/controllers/IndexController.php

Within each admin module the normal ZF rules for URL routing applies. For convenience my bootstrap resource also sets up an ID route:

domain.com/admin/user/groups/view/4
-> application/admin-modules/user/controllers/GroupsController.php / viewAction
passing a param called “id” with a value of 4.

The filesystem structure works as so:

application/
            admin-modules/
                          default/
                                  controllers/
                                  etc..
                          user/
                               controllers/
                               etc..

So admin-modules basically works like a copy of the main modules folder. Just for admin-only modules.

To enable this simply add the following line to your Zend_Application application.ini config file:

; Register a custom Bootstrap resource path (needs to be in your include path)
pluginPaths.S24_Application_Resource = "S24/Application/Resource"

; Enable admin modules
resources.adminModules.enable = []

Note: Please now see the sub-modules system for an improved way to implement this.