Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      Stop writing tests: Automate fully with Generative AI

      August 19, 2025

      Opsera’s Codeglide.ai lets developers easily turn legacy APIs into MCP servers

      August 19, 2025

      Black Duck Security GitHub App, NuGet MCP Server preview, and more – Daily News Digest

      August 19, 2025

      10 Ways Node.js Development Boosts AI & Real-Time Data (2025-2026 Edition)

      August 18, 2025

      This new Coros watch has 3 weeks of battery life and tracks way more – even fly fishing

      August 20, 2025

      5 ways automation can speed up your daily workflow – and implementation is easy

      August 20, 2025

      This new C-suite role is more important than ever in the AI era – here’s why

      August 20, 2025

      iPhone users may finally be able to send encrypted texts to Android friends with iOS 26

      August 20, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      Creating Dynamic Real-Time Features with Laravel Broadcasting

      August 20, 2025
      Recent

      Creating Dynamic Real-Time Features with Laravel Broadcasting

      August 20, 2025

      Understanding Tailwind CSS Safelist: Keep Your Dynamic Classes Safe!

      August 19, 2025

      Sitecore’s Content SDK: Everything You Need to Know

      August 19, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      Why GNOME Replaced Eye of GNOME with Loupe as the Default Image Viewer

      August 19, 2025
      Recent

      Why GNOME Replaced Eye of GNOME with Loupe as the Default Image Viewer

      August 19, 2025

      Microsoft admits it broke “Reset this PC” in Windows 11 23H2 KB5063875, Windows 10 KB5063709

      August 19, 2025

      How to Fix “EA AntiCheat Has Detected an Incompatible Driver” on Windows 11?

      August 19, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»News & Updates»CodeSOD: The Big Pictures

    CodeSOD: The Big Pictures

    May 6, 2025

    Loading times for web pages is one of the key metrics we like to tune. Users will put up with a lot if they feel like they application is responsive. So when Caivs was handed 20MB of PHP and told, “one of the key pages takes like 30-45 seconds to load. Figure out why,” it was at least a clear goal.

    Combing through that gigantic pile of code to try and understand what was happening was an uphill battle. Eventually, Caivs just decided to check the traffic logs while running the application. That highlighted a huge spike in traffic every time the page loaded, and that helped Caivs narrow down exactly where the problem was.

    $first_image = '';
    foreach($images as $the_image)
    { 
        $image = $the_image['url'];
     
      if(file_exists($config->base_url.'/uploads/'.$image))
      {
        if($first_image=='')
        {
          $first_image = $image;
        }
       
        $image_dimensions = '&w=648&h=432';
        $get_dimensions = getimagesize('http://old.datacenter.ip.address/'.$config->base_url.'/uploads/'.$image);
        if($get_dimensions[0] < $get_dimensions[1])
          $image_dimensions = '&h=432';
    
        echo '<li>'.$config->base_url.'/timthumb.php?src='.$config->base_url.'/uploads/'.$image.'&w=125&h=80&zc=1'), 'javascript:;', array('onclick'=>'$('.image_gallery .feature .image').html(''.$config->base_url.'/timthumb.php?src='.$config->base_url.'/uploads/'.$image.$image_dimensions.'&zc=1').'');$('.image_gallery .feature .title').show();$('.image_gallery .feature .title').html("'.str_replace('"', '', $the_image['Image Description']).'");$('.image_gallery .bar ul li a').removeClass('active');$('.image_gallery .bar ul li').removeClass('active');$(this).addClass('active');$(this).parents('li').addClass('active');sidebarHeight();curImg=$(this).attr('id');translate()','id'=>$img_num)).'</li>';
        $img_num++;
      }
    }
    

    For every image they want to display in a gallery, they echo out a list item for it, which that part makes sense- more or less. The mix of PHP, JavaScript, JQuery, and HTML tags is ugly and awful and I hate it. But that’s just a prosaic kind of awful, background radiation of looking at PHP code. Yes, it should be launched into the Kupier belt (it doesn’t deserve the higher delta-V required to launch it into the sun), but that’s not why we’re here.

    The cause of the long load times was in the lines above- where for each image, we getimagesize– a function which downloads the image and checks its stats, all so we can set $image_dimensions. Which, presumably, the server hosting the images uses the query string to resize the returned image.

    All this is to check- if the height is greater than the width we force the height to be 432 pixels, otherwise we force the whole image to be 648×432 pixels.

    Now, the server supplying those images had absolutely no caching, so that meant for every image request it needed to resize the image before sending. And for reasons which were unclear, if the requested aspect ratio were wildly different than the actual aspect ratio, it would also sometimes just refused to resize and return a gigantic original image file. But someone also had thought about the perils of badly behaved clients downloading too many images, so if a single host were requesting too many images, it would start throttling the responses.

    When you add all this up, it meant that this PHP web application was getting throttled by its own file server, because it was requesting too many images, too quickly. Any reasonable user load hitting it would be viewed as an attempted denial of service attack on the file hosting backend.

    Caivs was able to simply remove the check on filesize, and add a few CSS rules which ensured that files in the gallery wouldn’t misbehave terribly. The performance problems went away- at least for that page of the application. Buried in that 20MB of PHP/HTML code, there were plenty more places where things could go wrong.

    [Advertisement]
    Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!

    Source: Read More 

    Facebook Twitter Reddit Email Copy Link
    Previous ArticleQuantum Systems raises €160M for AI-powered aerial intelligence
    Next Article TEKEVER becomes the latest unicorn in Europe’s defencetech industry

    Related Posts

    News & Updates

    This new Coros watch has 3 weeks of battery life and tracks way more – even fly fishing

    August 20, 2025
    News & Updates

    5 ways automation can speed up your daily workflow – and implementation is easy

    August 20, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    CVE-2025-33072 – Azure Azure Network Information Disclosure

    Common Vulnerabilities and Exposures (CVEs)

    CVE-2025-2812 – Mydata Informatics Ticket Sales Automation SQL Injection

    Common Vulnerabilities and Exposures (CVEs)

    School of Architecture and Planning welcomes new faculty for 2025

    Artificial Intelligence

    CVE-2025-4423 – Lenovo Remote Code Execution Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    Highlights

    CVE-2025-3740 – “WordPress School Management System Local File Inclusion Vulnerability”

    July 18, 2025

    CVE ID : CVE-2025-3740

    Published : July 18, 2025, 5:15 a.m. | 59 minutes ago

    Description : The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the ‘page’ parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The Local File Inclusion exploit can be chained to include various dashboard view files in the plugin. One such chain can be leveraged to update the password of Super Administrator accounts in Multisite environments making privilege escalation possible. The vendor has updated the version numbers beginning with `1.93.1 (02-07-2025)` for the patched version. This version comes after version 93.1.0.

    Severity: 8.8 | HIGH

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    Best Free and Open Source Alternatives to Progress Kemp LoadMaster

    April 1, 2025

    Tony Hawk’s Pro Skater 3 + 4 demo now is available now if you preorder — Michelangelo is coming too

    June 10, 2025

    Training LLMs to self-detoxify their language

    April 14, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.