The symfony core team released new versions of three branches (1.2, 1.3 and 1.4) fixing a security vulnerability in the Doctrine admin generator. The new versions are 1.2.12, 1.3.3 and 1.4.4.

All our servers have been upgraded but if you are using the admin generator in your site, it is important that you clear the symfony cache. On shared hosting you can do so by login to the Control Panel and using Maestro. On a VPS, through SSH and as root run the following command: “cd /usr/local/php; git pull” and then clear your symfony cache.

A big topic during Symfony Live 2010 was the need of quality web applications developed using symfony. CMS (content management system) applications are core to modern web development and until recently, even just 6 months ago or so, there were few available options built in symfony. Projects like SimpleCMS and Sympal had been started and while they showed potential, they were still in the early stages of development.

This scenario has changed quite a bit in the past month. At the time of this post, there are three major open source CMS applications: Apostrophe, Diem and Sympal. We expect a fair number of these apps to be installed on our platform so we decided to dig in and test them out. As with any application, no CMS can fit everybody’s needs and workflow, so we don’t think there is one CMS that will rule them all. The idea is not to find the best CMS, but to highlight the strengths and weakness of each option and comment on any places where we see room for improvement. Of course, these projects are relatively new, so I am sure there will be plenty of room for improvement and with time and contributions from developers and designers things will get better. We encourage anyone with an interest in any of these projects to join in the discussion and leave comments below and ask the current developers if they need contributors (I think I already know the answer to that!). I am also sure there are plenty of other CMS systems developed with symfony that have not been released open source and would be nice if companies can contribute back to the community by releasing them into the public. In case we missed something be sure to let us know.

We will review the applications in alphabetical order and will start with Apostrophe developed by the fine folks at P’unk Avenue.

Apostrophe

Apostrophe's site

Getting started

Apostrophe can be found at http://www.apostrophenow.com/. The website is clean and simple and they provide a full-feature demo and this video to help get the feel for the application.

Apostrophe CMS Screencast (EMAP) from Apostrophe on Vimeo.

Concepts and key features

• pages: Apostrophe places content in pages. These pages are dynamically created through a nice, clean and concise UI. You can define the template for each page, allowing to have different layouts for your home page, internal and special pages. When you add a page, breadcrumbs, menus and sitemap get updated automatically which can save lots of time and prevent broken links.
• slots: A page has areas for content called slots. These slots can contain very diverse data. By default several slot types are provided: rich text, slideshow, video, image, RSS feed, PDF, button, plain text and raw HTML. We will go into more details later on.
• media: Out of the box, you get a media manager which allows you to add images, videos and documents into a library that then can be used to locate and link from your pages and slots.
• history of changes: when you make a change in a slot, let’s say a rich text, the change gets stored in a history log which can then be accessed for review. You can also revert back to a previous version of the content, which is super-useful. It also works on other slot types, like in the RSS feed it keeps track of the changes in the URL, although it does not show the URL for each revision which would be very handy.
• Ajax-enabled UI: The admin elements of the system are displayed and loaded only when you need them. In the demo and installed sandbox, which provides a sample site as starting point, the buttons and menus do not obstruct the general flow of the page, and do not distort the view. It will be interesting to see how it works with other type of sites and more custom CSS layouts.
• search-enabled: Apostrophe uses Zend_Search to index content and provide search functionality out of the box. The index is stored in the filesystem by default.

History of changes

Installation

You have a few different options to install Apostrophe: sandbox, svn checkout and plugin installation.

The installation document is very good, with enough explanation for each required step. We picked to download the sandbox tarball, which includes the symfony project skeleton, all the plugins and dependencies needed and a sample site ready to be used. This is probably the quickest way to get started in your own server. It literally took about 5 minutes to download the file, uncompress it, create the needed configuration files (sample files for both config/databases.yml and config/properties.ini are provided), create the database and load the fixtures, and finally run a series of symfony tasks to make sure files can be written by the web server.

I created a virtual host entry in our Apache:

<VirtualHost *:80>
 DocumentRoot /Users/user/Sites/asandbox/web
 ServerName asandbox.local

<Directory /Users/user/Sites/asandbox/web>
AllowOverride All
</Directory>

</VirtualHost>

Notice the AllowOverride directive in the Directory block. This is very important to make sure the .htaccess file included in the web directory gets used by Apache to assure full functionality  of the CMS features.

Then I added the asandbox.local to the /etc/hosts file and restarted Apache.

First impressions

When loading the site for the first time, I got a nice page with some sample content.

Sample site

In the top-right corner there is a Login button. When you click on it a nice login form appears and the default login is admin/demo. Upon logging in, the page refreshes and now you get to see all the admin elements, including a menu on the top of the page which gives you access to configure and add pages, media, reorganize your site structure and manage users and permissions.

Editing a page allows to set basic things like name, access level, template, editing permissions and page engine (more on this later).

Editing page

The media manager allows you to add images from your computer, videos from Youtube and others using embed code, and PDF documents.

Reorganizing the site structure of the site is done by dragging pages in a tree component which is very cool and simple to use. This in turn, updates the breadcrumbs and menus automatically.

Reorganizing site

When you want to add content to a page, you need to add a slot to the section of the page you want. If you need to add some rich text, you use the analogous slot type and a WYSIWYG (FCKeditor) is shown in place. Upon saving, the editor is hidden and the content displayed. If you need to create a slideshow, you add the slot, then select the images from the media library and done! Displaying news from a remote site is super easy, just add a RSS feed slot, enter the URL and see the articles fill up the page. And of course, you can create your own slots.

Help for everybody

The team behind Apostrophe made sure everybody, from developers, editors to designers have at least some kind of documentation to refer to. So if you are a designer and need to customize the layout or work with templates, make sure to read the Designer’s guide. There are also editor’s and developer’s guides.

Installing Apostrophe on shared hosting

Running symfony applications on shared hosting can sometimes be challenging but installing Apostrophe using Maestro can happen in a matter of minutes! There is no doubt we are kicking some hosting butt here. If you want to run Apostrophe on our shared hosting servers, we recommend that you upload the entire project directory (ie. the sandbox directory) into the symfony_projects folder and use Maestro to setup the web server for you. This is a simple process and helps you avoid having to mess with modrewrite rules and so on. Just make sure you do not override the .htaccess file as Apostrophe already provides one for you.

Installing Apostrophe on VPS servers

VPS servers customers have full access to their environment so there are no special steps required if you want to install Apostrophe in a VPS. Just make sure you follow the instructions provided in the installation manual.

Closing notes

A lot of thought, time and effort has been put in Apostrophe. The first stable version was released just before Symfony Live. The system allows you to have a CMS-enabled site running in matter of minutes, which is something most developers of small sites need. Since it is developed on top of symfony and as a plugin, you can use it along other symfony applications and you can extend its functionality to add custom features, a key part of today’s needs.

We want to congratulate and thank P’unk Avenue for releasing this CMS as an open source project. Make sure to follow their blog for updates and if you want to contribute don’t hesitate to join the google group.

Next week we will be present at Symfony Live 2010, the second edition of this conference where symfony developers meet to learn and network. We are very excited to not only be present but also  sponsor supporting the symfony community.

If you can’t make it to Paris, keep checking this blog for daily updates or follow us on twitter for more frequent notes.  In the case you will be present, please say hi and introduce yourself, we are looking forward to meet clients and developers.

à bientôt!

It is very common to have multiple applications in one symfony project, like frontend, backend, api, etc. The common way to access the application is by specifying the application front controller, like

• http://example.com/frontend.php
• http://example.com/backend.php
• http://example.com/api.php

Most of the time, it is nicer and better to use subdomains, like:

• http://www.example.com/
• http://backend.example.com/
• http://api.example.com/

There are some hacks (here, here and here) on the net that allows you to define the application and environment based on the domain. These are good options if you need something quick and do not want to mess with the web server configuration, but you lose some flexibility and specially, all the web server log entries end up in a single file. I think it is better to have the traffic go into separate files for reporting and debugging purposes.

You can accomplish this by setting up virtual hosts for each subdomain and define the front controller for each virtual host.

1) setup the DNS entry. The recommended way is to setup a CNAME record. If you have a A record that points your domain to the IP addresss (example.com A 1.2.3.4) then you can setup a CNAME record which will point your subdomain to the same IP address without having to specify the IP in each subdomain. Then if you need to change your IP address, you just change it in one location:

example.com. A 1.2.3.4
backend.example.com. CNAME example.com.
www.example.com. CNAME example.com.
api.example.com. CNAME example.com.

You can also define a wildcard DNS like:

*.example.com. CNAME example.com.

This will make any-subdomain.example.com point to your IP address.

2) once you have your DNS records in place, it is time to configure the web server. If you use Apache, you would setup several virtual hosts like the following:

<VirtualHost *:80>
DocumentRoot /usr/local/sfproject/web
ServerName backend.example.com
ErrorLog logs/backend-error_log
CustomLog logs/backend-access_log common

<Location />
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /backend.php [L]
</IfModule>
DirectoryIndex backend.php
</Location>

</VirtualHost>

<VirtualHost *:80>
DocumentRoot /usr/local/sfproject/web
ServerName www.example.com
ServerAlias example.com
ErrorLog logs/frontend-error_log
CustomLog logs/frontend-access_log common

<Location />
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /frontend.php [L]
</IfModule>
DirectoryIndex frontend.php
</Location>

</VirtualHost>

<VirtualHost *:80>
DocumentRoot /usr/local/sfproject/web
ServerName api.example.com
ErrorLog logs/api-error_log
CustomLog logs/api-access_log common

<Location />
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /api.php [L]
</IfModule>
DirectoryIndex api.php
</Location>

</VirtualHost>

Notice that the mod_rewrite rules that usually are included in a .htaccess file are directly specified in the virtual host. If you disable .htaccess files and specify this configuration in your virtual hosts, your web server will gain some speed. If you prefer to use .htaccess files for convenience, you can have multiple .htaccess files and define which file to use in each virtual host using the directive AccessFileName.

Notice how I linked all virtual hosts to the same symfony project, and defined the default page and mod_rewrite to point to each front controller.

3) restart your web server and test.

In order to setup something like this, you will need to have full access to your environment so it is only possible to accomplish in a VPS or dedicated server. This functionality is planned for the next release of Maestro for shared hosting.

Symfony’s forms are very powerful and big time-savers. Also, thanks for the integration with an ORM like Doctrine or Propel, managing dates is quite easy. But by default, symfony displays date fields as regular select lists where you pick the date (month, day, year, hour, minute)

It is actually quite easy to enhance this functionality and display a friendlier way to pick a date. There are several options at your disposal:

sfFormExtraPlugin

The sfFormExtraPlugin plugin has numerous widgets to improve the appearance and functionality of form input fields. One of them is sfWidgetFormJQueryDate which displays a button next to your field. When clicking on it, a date picker calendar-style pops up.

Note: You will need to download the jquery theme to make it look pretty.

To use it, simply install the plugin and add the following to your form configure() method:

        $this->widgetSchema['publish_at']= new sfWidgetFormJQueryDate();

Also, make sure you load the jquery javascript files in view.yml:

  javascripts:
    - http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js
    - http://ajax.googleapis.com/ajax/libs/jqueryui/1.7.2/jquery-ui.min.js

sfJQueryUIPlugin

The sfJQueryUIPlugin plugin is a nicer option. It displays a date picker when you click on the date input field, but it still allows you to modify it manually.

Installation is also quite easy. Install the plugin and add the following to your form configure method:

        $this->widgetSchema['publish_at']= new sfWidgetFormDateJQueryUI(array('change_month' => true, 'change_year'=> true));

Unobtrusive Datepicker

The Unobtrusive Datepicker by Massimiliano Arione is probably the nicer of the options, but also the less straightforward as there is no aparent plugin for it yet.

Follow the instructions on the site to get it working.

Any others?

Have you found any other solutions? Let us know and share it with us!

A problem I have often encountered when working with Symfony projects containing multiple applications is the maintenance of the non-production front controllers. These front controllers contain a default check of the client IP address and must be modified to allow requests from any system except localhost (127.0.0.1). The creator of the application is then left to “roll their own” access control in order to facilitate development while still restricting the world at large.

While this is not a problem for Symfony projects which contain a single application, maintenance of these non-production front controllers can quickly become bothersome as the number of applications in the project grows. Any time an allowed address is added or removed all these front controllers need updated manually.

Listing 1 contains a solution to this problem. The source of the front controllers to be restricted gets replaced with this code (with the proper application name, environment, and debug setting of course). It is assumed the same set of IP addresses will have access to all the front controllers which use this code.

Listing 1: web/frontend_dev.php

<?php

if (false !== ($hosts = @file(dirname(__FILE__).'/../config/hosts.allow')))
{
  $hosts = array_map('rtrim', $hosts);

  foreach ($hosts as $host)
  {
    if (substr(@$_SERVER['REMOTE_ADDR'], 0, strlen($host)) == $host)
    {
      require_once(dirname(__FILE__).'/../config/ProjectConfiguration.class.php');

      $configuration = ProjectConfiguration::getApplicationConfiguration('frontend', 'dev', true);
      sfContext::createInstance($configuration)->dispatch();

      exit(0);
    }
  }
}

header('HTTP/1.0 403');
echo '403 Forbidden';

As you can see, the list of allowed addresses is stored in the config/hosts.allow file. This file simply contains an IP address (or partial IP address) to be allowed on each line. A sample hosts.allow file can be found in listing 2.

Listing 2: config/hosts.allow

127.0.0.1
209.85.225.104
192.168.0.
69.147.11.

Problem solved. Now whenever a new IP address or set of addresses needs to be allowed access to your restricted front controllers they simply need added to the hosts.allow file.

It should be noted when matching IP address blocks: since the check uses a substring match on the client address the trailing “.” needs included in the hosts.allow file. Otherwise an allowed address of “69.147.11″ would match “69.147.111″, “69.147.112″, etc.

Happy coding!

Just one month to go for the 2nd symfony live conference! This year’s event will be in English even though the event will be held in Paris. Who said the French refuse to speak English in France? The event organizers have put together a great presentation lineup. This is a great opportunity to meet with symfony developers, learn more about symfony and most important to be part of the release of Symfony 2.

This is the second year we sponsor symfony live and we can’t wait! We are looking forward to meeting developers, clients and friends. If you are going to be there, look for us and say hi!

When Symfony 1.3 & 1.4 were released, little attention was given to a new feature that had tremendous potential: the installer. By adding –installer=installFile.php is possible to execute custom PHP code when creating a new symfony project.

So when I came across this I had an idea that could save us all some time. Every time we want to try some thing quick, do a prototype, test a plugin or simply start a new application, we create a new symfony project. The common workflow once the project is created is to add a new “virtual” hostname to the hosts file so we can reach the project through the browser, then add a virtual host to the Apache configuration, so the “virtual” hostname points to the correct web directory of the project, etc… These steps are repetitive and consume a bit of time and quite frankly I’d love to automate this whole thing. For that I created the symfony Web Development Environment Installer (also known as project codename: Swedein).

The installer will ask you a series of questions: ie. IP address, hostname, location of Apache installation. It can also locate the Apache configuration by looking for it in common places. Then it goes ahead and adds a line to the hosts file, adds the virtual host block to Apache’s configuration and restarts Apache. In a matter of seconds you should be ready to go.

To run the installer, you have a couple of options:

a) Download the installer file, rename it to SymWebDevInstaller.php and run:

symfony generate:project myproject --installer=path/to/SymWebDevInstaller.php

b) If you have support for http URLs in your PHP you can simply run:

symfony generate:project myproject --installer=http://labs.servergrove.com/SymWebDevInstaller/SymWebDevInstaller.php


Note: There is a bug in the generate:project task that prevents URLs from being used with the –installer option. This should be fixed soon.

This is being tested in:

• Windows XP with Zend Server CE
• Mac OS X with Zend Server CE
• CentOS Linux
• Ubuntu Linux

In Mac OS and Linux, the script will need to have permissions to update the hosts file and the Apache configuration. Make sure your user has permissions or use sudo to execute the installer. Restarting Apache is supported on Linux only. Other OSes coming soon.

We are looking for help to include and test in other types of installations and to add other improvements the community might think about. You can either check out the github repository where we can receive patches or send it to us and we will update it. We look forward to your feedback.

During December, symfony is releasing a chapter a day of the advent calendar. The articles are about advanced topics. So far we have read about routing, productivity enhancement, sending emails, custom widget and validators, forms, and one topic is about extending the Web Debug Toolbar.

The Web Debug Toolbar is one of the best features of symfony. It provides extensive information about your application (configuration & performance). The article explains how to extend the toolbar by adding custom panels. The possibilities are endless! Immediately after reading the article, I started thinking on different uses. I thought that a link checker would be a great addition. The idea would be to get all the links in the page currently looking at and detect broken links. So I started hacking something together. Here is the result.

Because the panel needs to check all links on the page, rendering the page gets slowed down considerably. So it becomes annoying after a few reloads, so I decided to only enable it by passing a parameter to the URL. By passing ?check_links to any URL in your project, it will check the links in the content of the response.

The panel also displays the title in red if there are any broken links by setting the status of the panel as described in the article. By clicking on the title, you get a list of all the links and its status.

I will prepare a plugin to encapsulate this functionality and I will release it. If you have any other ideas, let us know!

To install it, edit your config/ProjectConfiguration.class.php file and add this method:

  public function initialize()
  {
    $this->dispatcher->connect('debug.web.load_panels', array(
        'sgWebDebugPanelLinkChecker',
        'listenToLoadDebugWebPanelEvent'
    ));
  }

Then, download the sgWebDebugPanelLinkChecker.php class and put it in lib/debug. After that, add ?check_links to your URL and check it out. I actually found a couple of broken links in our site upon testing.

The article was great describing how to hide the panel, change its status and set the title and content, get a URL parameter, all features used in this example.

To do: Check https links.

I’ve been developing a website based on symfony. Since symfony 1.3 and 1.4 came out this week, I decided to upgrade it to 1.3 and then when I feel confortable to 1.4. The upgrade was a little bit more complicated that I anticipated, mainly because I was using some plugins that are not compatible with these new versions yet.

Then, I decided to run some benchmarks using ab (Apache Benchmark) to see how symfony 1.2 and 1.3 compared. To my surprise, I did not see an improvement on speed. I was expecting the new version would be faster, but for some reason I am not seeing any improvements. I have not gone into speed improvement measures yet, this was just out of curiosity with a symfony project pretty much straight out of the box. And my development box is not fancy or speedy, but for comparing both versions it would be OK.

When I turned on view caching, things really improved, doubling the requests/second rate. I am running PHP 5.3.1 here, so I am using all the new PHP memory handling and speed improvements, which is very good for frameworks since they tend to be heavy users.

Then, since I was already dancing, I dediced to install APC, an free opcode cache. Basically it caches PHP compiled source code so subsequent requests do not have to do the parsing of PHP files. It always improves performance without touching a single line of code. But to my surprise, I got an increase from about 14 requests/sec (remember, this server is not fast at all!) to over 70 requests/sec !!! That’s 5x times faster!

It also includes a nice web page with status and statistics of cached data.

I did not get into more tweaking, but you can see there is a big difference. That’s why all our VPS servers come with APC installed by default, so you can get all the juice from your server. And that’s why you need to use it whenever possible.