Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      CodeSOD: A Unique Way to Primary Key

      July 22, 2025

      BrowserStack launches Figma plugin for detecting accessibility issues in design phase

      July 22, 2025

      Parasoft brings agentic AI to service virtualization in latest release

      July 22, 2025

      Node.js vs. Python for Backend: 7 Reasons C-Level Leaders Choose Node.js Talent

      July 21, 2025

      The best CRM software with email marketing in 2025: Expert tested and reviewed

      July 22, 2025

      This multi-port car charger can power 4 gadgets at once – and it’s surprisingly cheap

      July 22, 2025

      I’m a wearables editor and here are the 7 Pixel Watch 4 rumors I’m most curious about

      July 22, 2025

      8 ways I quickly leveled up my Linux skills – and you can too

      July 22, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      The Intersection of Agile and Accessibility – A Series on Designing for Everyone

      July 22, 2025
      Recent

      The Intersection of Agile and Accessibility – A Series on Designing for Everyone

      July 22, 2025

      Zero Trust & Cybersecurity Mesh: Your Org’s Survival Guide

      July 22, 2025

      Execute Ping Commands and Get Back Structured Data in PHP

      July 22, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      A Tomb Raider composer has been jailed — His legacy overshadowed by $75k+ in loan fraud

      July 22, 2025
      Recent

      A Tomb Raider composer has been jailed — His legacy overshadowed by $75k+ in loan fraud

      July 22, 2025

      “I don’t think I changed his mind” — NVIDIA CEO comments on H20 AI GPU sales resuming in China following a meeting with President Trump

      July 22, 2025

      Galaxy Z Fold 7 review: Six years later — Samsung finally cracks the foldable code

      July 22, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»News & Updates»CodeSOD: The Big Pictures

    CodeSOD: The Big Pictures

    May 6, 2025

    Loading times for web pages is one of the key metrics we like to tune. Users will put up with a lot if they feel like they application is responsive. So when Caivs was handed 20MB of PHP and told, “one of the key pages takes like 30-45 seconds to load. Figure out why,” it was at least a clear goal.

    Combing through that gigantic pile of code to try and understand what was happening was an uphill battle. Eventually, Caivs just decided to check the traffic logs while running the application. That highlighted a huge spike in traffic every time the page loaded, and that helped Caivs narrow down exactly where the problem was.

    $first_image = '';
    foreach($images as $the_image)
    { 
        $image = $the_image['url'];
     
      if(file_exists($config->base_url.'/uploads/'.$image))
      {
        if($first_image=='')
        {
          $first_image = $image;
        }
       
        $image_dimensions = '&w=648&h=432';
        $get_dimensions = getimagesize('http://old.datacenter.ip.address/'.$config->base_url.'/uploads/'.$image);
        if($get_dimensions[0] < $get_dimensions[1])
          $image_dimensions = '&h=432';
    
        echo '<li>'.$config->base_url.'/timthumb.php?src='.$config->base_url.'/uploads/'.$image.'&w=125&h=80&zc=1'), 'javascript:;', array('onclick'=>'$('.image_gallery .feature .image').html(''.$config->base_url.'/timthumb.php?src='.$config->base_url.'/uploads/'.$image.$image_dimensions.'&zc=1').'');$('.image_gallery .feature .title').show();$('.image_gallery .feature .title').html("'.str_replace('"', '', $the_image['Image Description']).'");$('.image_gallery .bar ul li a').removeClass('active');$('.image_gallery .bar ul li').removeClass('active');$(this).addClass('active');$(this).parents('li').addClass('active');sidebarHeight();curImg=$(this).attr('id');translate()','id'=>$img_num)).'</li>';
        $img_num++;
      }
    }
    

    For every image they want to display in a gallery, they echo out a list item for it, which that part makes sense- more or less. The mix of PHP, JavaScript, JQuery, and HTML tags is ugly and awful and I hate it. But that’s just a prosaic kind of awful, background radiation of looking at PHP code. Yes, it should be launched into the Kupier belt (it doesn’t deserve the higher delta-V required to launch it into the sun), but that’s not why we’re here.

    The cause of the long load times was in the lines above- where for each image, we getimagesize– a function which downloads the image and checks its stats, all so we can set $image_dimensions. Which, presumably, the server hosting the images uses the query string to resize the returned image.

    All this is to check- if the height is greater than the width we force the height to be 432 pixels, otherwise we force the whole image to be 648×432 pixels.

    Now, the server supplying those images had absolutely no caching, so that meant for every image request it needed to resize the image before sending. And for reasons which were unclear, if the requested aspect ratio were wildly different than the actual aspect ratio, it would also sometimes just refused to resize and return a gigantic original image file. But someone also had thought about the perils of badly behaved clients downloading too many images, so if a single host were requesting too many images, it would start throttling the responses.

    When you add all this up, it meant that this PHP web application was getting throttled by its own file server, because it was requesting too many images, too quickly. Any reasonable user load hitting it would be viewed as an attempted denial of service attack on the file hosting backend.

    Caivs was able to simply remove the check on filesize, and add a few CSS rules which ensured that files in the gallery wouldn’t misbehave terribly. The performance problems went away- at least for that page of the application. Buried in that 20MB of PHP/HTML code, there were plenty more places where things could go wrong.

    [Advertisement]
    Utilize BuildMaster to release your software with confidence, at the pace your business demands. Download today!

    Source: Read More 

    Facebook Twitter Reddit Email Copy Link
    Previous ArticleQuantum Systems raises €160M for AI-powered aerial intelligence
    Next Article TEKEVER becomes the latest unicorn in Europe’s defencetech industry

    Related Posts

    News & Updates

    The best CRM software with email marketing in 2025: Expert tested and reviewed

    July 22, 2025
    News & Updates

    This multi-port car charger can power 4 gadgets at once – and it’s surprisingly cheap

    July 22, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    CVE-2025-44835 – D-Link DIR-816 Command Injection Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    Chimera is a general-purpose Linux-based OS

    Linux

    OpenRefine – desktop program for data cleanup and transformation

    Linux

    AI updates from the past week: OpenAI Codex, AWS Transform for .NET, and more — May 16, 2025

    Tech & Work

    Highlights

    CVE-2025-32376 – Discourse DM Privilege Escalation Vulnerability

    April 30, 2025

    CVE ID : CVE-2025-32376

    Published : April 30, 2025, 3:16 p.m. | 1 hour, 42 minutes ago

    Description : Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable version 3.4.3 and beta version 3.5.0.beta3.

    Severity: 0.0 | NA

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    Distillation Scaling Laws

    June 3, 2025

    CVE-2024-45347 – Xiaomi Mi Connect Service APP Unauthorized Access Vulnerability

    June 23, 2025

    The AI video tool behind the most viral social trends right now

    June 14, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.