<![CDATA[Esvon LTD]]> <![CDATA[Multiple vulnerabilities have been identified in older PHP versions]]> As multiple vulnerabilities have been identified in older PHP versions recently and PHP 8.0 reached EOL in 2023, PHP 8.2/8.3 compatible version of Esvon Classifieds is available.

Download Demo or registered version from Client Area

]]> <![CDATA[At least 60% of all websites are impacted by jQuery XSS vulnerabilities]]> Unless you are using jQuery 3.4+ then you are using vulnerable jQuery versions.

These findings come from open source security platform, Snyk, and are included in "The state of JavaScript frameworks security report 2019". 

In jQuery Snyk tracked six security vulnerabilities affecting jQuery across all of its releases to date. Four are medium severity Cross-Site Scripting vulnerabilities, one is a medium severity Prototype Pollution vulnerability, and the final one is a low severity Denial of Service vulnerability. 

More Information

Snyk Javascript Report 2019 (pdf)

]]> <![CDATA[How Google PageSpeed works]]> There have been a couple of crucial changes made to Google's search indexing and ranking algorithms.

If you've been curious about how PageSpeed calculates it's critical speed score and how to make it work for you to improve your SEO ranking and ad quality score - this article will give you the details:

https://calibreapp.com/blog/how-pagespeed-works/

]]> <![CDATA[Upgrade to PHP 7.2 - success story of performance-wise move]]> One of our customers got a good deal on a new VPS with EasyApache4. Before he had VPS with EasyApache3 where switching to PHP 7 was complicated.

We were asked to make sure pages serving is as fast as possible and that task included migration from PHP 5.6 to PHP 7.2.

Initial configuration included Apache 2.4 + mod_mpm_prefork + PHP 5.6 (suEXEC).

Website's index page is very rich with PHP-generated content so all speed tests were made on it using Apache bench command:

ab -n 500 -c 10 https://www.domain.com/

PHP 5.6 (suEXEC) results: 16 requests per second in average. Very slow. By the way suEXEC is making things slow too comparing to php-fpm.

New configuration included Apache 2.4 + mod_mpm_worker + PHP 7.2 (php-fpm).

PHP 7.2 (php-fpm) results: 83-101 requests per second. The difference can be amazing (6x faster). With EasyApache4 it is easy to switch between PHP versions so we tested the same configuration on PHP 7.1 and got 75-88 requests per second.

What contributed to this performance increase? At least 3 things:

1/ PHP 7.2 is the fastest in PHP line
2/ Handing PHP work off to PHP FPM makes a HUGE improvement in memory utilization (Server API = FPM/FastCGI in phpinfo output)
3/ Threaded worker Multi-Processing Module for Apache HTTP Server mod_mpm_worker is faster than mod_mpm_prefork

Merry Christmas !

]]> <![CDATA[Learning to create or modify responsive Bootstrap-based layouts ?]]> # The Ultimate Guide to Bootstrap:
http://www.webdesignerdepot.com/2014/10/the-ultimate-guide-to-bootstrap/

# Bootstrap Starter Templates (with demo and code)
http://www.bootply.com/templates/

# BOOTSTRAP LAYOUT BUILDERS
LayoutIT.Com
brix.io

]]> <![CDATA[Web software challenges 2014]]>
Recently we were focusing on turning problems into tasks and finding solutions.
Of course this process can be lifelong but if you're interested to see a short list
of completed tasks we experienced in web software area, here they are.

We used plain text format using these signs: * Problem / # Solution

* Website is not good for mobile devices

# New responsive Bootstrap-based website template:
http://www.esvon.com/products/cl/

If you want something different or would like to see what are other options with Bootstrap,
here are some already developed template examples:
http://wrapbootstrap.com/theme/bootlistings-bootstrap-classifieds-WB0C342C2?ref=es
http://wrapbootstrap.com/theme/bootstrap-real-estate-WB02793H5?ref=es

* Need more than the same header/footer for all pages, multiple header/footer files
for different pages, difficult to maintain, etc.

# Improved individual pages layout customization:
http://www.esvon.com/products/cl/pg-bar_hide.html
http://www.esvon.com/products/cl/pg-bar_clean.html
Examples where this functionality is already used - User Menu and Refine Search at the left sidebar.

* Website performance issues when accessed by many visitors.

# Sessions started only when they are actually used.
The same thing is mentioned as YII 2 framework new feature by the way.
Possibility for caching of dynamic HTTP content by HTTP reverse proxy like Varnish or nginx for significant performance increase.
Story from real life : https://www.rfxn.com/nginx-caching-proxy/

* Large images upload takes too long for remote users or on slow connections

# Plupload support integrated with ability to have images resized on client side before sending to the server

* Banning spamers using banned_ips.txt file not always working

# Fixed code in admin/spam.php which is updating banned_ips.txt automatically
when you select "ban user IP address" link in "Modify Listing" page in Admin Area.
In your existing install you may want to make sure your banned_ips.txt file has
one IP address per line without any brackets, just digits and dots and/or request
code update from us.

These are some of the changes in Esvon Classifieds 4.0.15.

This message is sent just to keep you informed.
We'll be happy to read your thoughts if you have any to share.

-----
Sincerely,
Esvon Team]]> <![CDATA[Easy-to-setup website for Amazon books selling]]>
With Amazon Store Builder script you can add relevant Amazon books to ANY existing website or create brand new online store in quite a simple way. The script is great for small stores, offering limited amount of specific books matching to your website content. No need to bother with a more complex system like WordPress and worry about exploits and security patches.

Just add preferred books with images, define categories, enter your Associates ID and you can start]]> <![CDATA[Future PHP versions compatibility (PHP 5.4+)]]>
For the existing users we recommend to stay on PHP 5.2.x as long as possible till you have enough reasons to switch to PHP 5.3+.
You can contact us and we'll do our best to help you to make PHP version switch smooth and transparent for your website users.]]> <![CDATA[PHP 5.3.10 released to fix a serious bug]]>
This time it is a bug that allows arbitrary remote code execution. This means that it allows to run arbitrary code on the server, injected by an eventual attacker, so it can be used to cause many types of damage inside a server.

We recommend you to upgrade to PHP 5.3.10 because if you are not vulnerable to this remote code execution security bug, you are vulnerable to the hash collision problem which was fixed in 5.3.9

P.S. Suhosin is a PHP extension that is meant to protect PHP installations against known and unknown PHP security bugs]]> <![CDATA[Critical issue is fixed in PHP 5.3.5 and 5.2.17 (32-bit systems)]]>
Referring to: http://bugs.php.net/53632

PHP 5.3.5 and 5.2.17 were released quickly to address critical bug discovered on 30/12/2010, looks like the earlier PHP versions on 32-bit systems are vulnerable to simple Denial of Service attack by remote user which will bring your server to its knees (exhaust server's CPU resources).

Solution: install patch or the latest PHP version (we recommend 5.2.17 for compatibility's sake).

As the temporary solution you can use the following mod_security rule:
SecRule QUERY_STRING "\d+e\-\d+" "phase:2,deny,status:403"

Sincere wishes
to 100% uptime of your websites

------
The Esvon Team]]> <![CDATA[Merry Christmas from Esvon Team]]>
We wish you and your family Merry Christmas and Happy 2011
and would like to share with you video greeting from our
"woman of respect" Kay Arthur:
http://www.lightsource.com/ministry/precepts/

This lady has already helped and continues to help many people
(in particular, by developing course "Marriage without Regret")
to cure soul, relations, broken families, to re-think husband/wife
roles in a family, to address man/woman communication issues,
love, consistency, intimate relations, attitude to money, children
raising, openly discuss questions of divorse, 2nd marriage and so on..

You can try to watch "Precepts for Life", hosted by Kay Arthur,
the only TV and radio program that takes you through the Bible book
by book, verse by verse. Kay's warm yet direct teaching respects
the audience with love and accountability:
http://www.precept.org/site/PageServer?pagename=brd_PFL_overview

Finally, if you live within US/Canada, this link may be useful for you:
http://classes.preceptnetwork.org/

Thank you very much for your attention.

Sincere wishes
to your continued success

------
The Esvon Team]]> <![CDATA[One Of My Website is Hacked (Repeatedly), What is the Best Thing To Do?]]>
http://www.hotscripts.com/forums/lounge/54147-one-my-website-hacked-repeatedly-what-best-thing-do.html]]> <![CDATA[Thoughts in server / PHP-based website performance optimization]]>
We'd like to share some thoughts regarding PHP-based website performance optimization with you and really hope you will find something useful to think about
and to make further research before making actual changes in your server environment.

1/ PHP 5.3

New PHP 5.3 offers a significant performance gain over previous PHP versions - try Google search on "PHP 5.3 performance" and you will get some real digits

2/ eAccelerator

eAccelerator installation allows to serve PHP content about 3 times faster (it may vary), don't forget to have Zend Optimizer installed after eAccelerator in php.ini ( see http://eaccelerator.net/wiki/TroubleShooting )

3/ Client side - caching

All static content (HTML pages, images, etc) can be cached in the browser by Expires header and Cache-Control header for 30-45 days (look at "mod_expires" Apache module).
Client-side cache can significantly improve the second visit, you'll get happy returning visitors and reduced bandwidth usage

4/ Use Nginx for font-end

Nginx usage for front-end and Apache for back-end is very beneficial for heavily loaded servers.
Nginx serves static content very efficiently, acts as reverse proxy for dynamic content (Apache/PHP) and allows to reduce memory consumption (RAM requirements).
You can start thinking about this model if your server load exceeds 10 http-requests per second

5/ MySQL

5a/ Query cache and buffer sizes

Make sure MySQL query cache is enabled and has proper size (you can start with 4MB or 64MB depending on the RAM available, use "query_cache_size" parameter in my.cnf)
Pay attention to "key_buffer" and "table_cache" parameters, they are important and shouldn't be too small.

5b/ InnoDB (selective)

This option is not for low end VPS, where InnoDB should be disabled to save memory.
In MySQL it is wise to change type of certain tables from MyISAM to InnoDB. MyISAM uses table-level blocking, InnoDB uses row-level blocking.
Conversion to InnoDB is useful for tables which experience many SQL updates (i.e. more than 20% write to 80% reads, e.g., session, hits, accesslog tables).
Don't forget to balance the amount of RAM between MyISAM and InnoDB because the buffers for each are configured separately.

5c/ Disable MySQL DNS Hostname Lookup

Add line "skip-name-resolve" in my.cnf, but you can only use IP numbers in the MySQL Grant table if you activate this option.

6/ TMPFS

Consider TMPFS usage, virtual memory is much faster than a persistent storage device.

Sincere wishes
to outstanding website performance

------
The Esvon Team]]> <![CDATA[Increase PHP pages serving speed]]>
Sooner or later your website reaches the point when you start thinking about performance. We have already shared our knowledge in this area obtained from wise books, public sources and from our previous experience at http://www.esvon.com/pg/services/performance/ but we can try to simplify this topic.

The simplest way to make your PHP pages fly is compiler cache installation. Zend offers commercial solution "Zend Platform" for this
purpose, but free open source alternative is available as well - eAccelerator ( http://www.eaccelerator.net/ ).

eAccelerator can help PHP to load files much faster, so if you were thinking about performance improvement possibilities recently, you may want to consider eAccelerator install.

Tip: Zend Optimizer must be installed after eAccelerator in php.ini so it's loaded after eAccelerator ( http://eaccelerator.net/wiki/TroubleShooting ).

Ilia Alshanetsky ( www.ilia.ws ) recently did a good talk on php performance (at php tek) that you might be interested in if you have not already seen it. You can download the pdf of it at http://ilia.ws/files/phptek2007_performance.pdf (be sure to check page 4 where compiler cache usage benefits are shown in digits).

Sincere wishes
to optimal website performance

------
The Esvon Team]]> <![CDATA[Esvon Classifieds upgrade in 10 minutes (3.x to 4.x)]]>
If you're running Esvon Classifieds 3.x and consider upgrading to version 4,
you may find the following information interesting.

We'd like to share a short movie covering upgrade steps from version 3.x to 4
(we used Windows server for this purpose, but the steps are the same on Linux).

http://rapidshare.com/files/7573623/v3_to_v4.zip
Length: 10 minutes
File size: 8.5 MB
Just unzip the archive and open v3_to_v4.html file.

You can always install v4 in a test environment (separate folder at your website)
to see how easy the upgrade process will be.

Please let us know if you have any questions

------
The Esvon Team
]]>