Received: from mailproxy.hargreaveslansdown.co.uk (172.16.18.68) by HLEXCAS01.hargreaveslansdown.co.uk (10.10.10.81) with Microsoft SMTP Server (TLS) id 14.2.247.3; Fri, 30 Mar 2012 13:05:51 +0100 Received: from cluster-a.mailcontrol.com (unknown [85.115.52.190]) by Websense Email Security Gateway with ESMTPS id 4FB308001E for ; Fri, 30 Mar 2012 13:07:33 +0000 (GMT) Received: from lists.php.net (pb1.pair.com [76.75.200.58]) by rly08a.srv.mailcontrol.com (MailControl) with ESMTP id q2UC5mhq014088 for ; Fri, 30 Mar 2012 13:05:49 +0100 X-Host-Fingerprint: 76.75.200.58 pb1.pair.com Received: from [76.75.200.58] ([76.75.200.58:25584] helo=lists.php.net) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 75/E7-53104-B91A57F4 for ; Fri, 30 Mar 2012 07:05:47 -0500 Received: (qmail 90885 invoked by uid 1010); 30 Mar 2012 12:05:30 -0000 Mailing-List: contact php-general-help@lists.php.net; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: list-post: List-Id: php-general.lists.php.net Delivered-To: mailing list php-general@lists.php.net Received: (qmail 90878 invoked from network); 30 Mar 2012 12:05:30 -0000 Authentication-Results: pb1.pair.com smtp.mail=dgobrien@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=dgobrien@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.42 as permitted sender) X-PHP-List-Original-Sender: dgobrien@gmail.com X-Host-Fingerprint: 74.125.82.42 mail-wg0-f42.google.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=E7lK8eLewYzvwZJmovgU3vp1D+vfmxublIcePhJnJZA=; b=x3dkO0rmQD7T4DA1216XDwze9PbPd1YQlsPGMUzhYA8JLV9l80+ymDbUoxJ12Dyw5v RLdYpT/MLo+RbvWtmqJYFxg5FYWNHyAAr9tcCg/AGkGB3l4+GIreUIPEvSudf3Uir63U Tz5qY61fkhdi1y5eDkAienKDs7TpaS5DHSM4o+ErYF1Pc8ZMSXQdVSq+V2rITor5N6kI iFRNhkcy/uG+63EgJzMqzlDUzXJFAPmOnMUVsI1Y2c3gRncUisVT72vOGw/nXj87bfTs FFxP8+e3U0rXlvGe5vH/beAk+XqGmMPwP8sfpSZW1sI8G3fE42/XXLeHMJkaER92WlS5 9NIQ== MIME-Version: 1.0 In-Reply-To: References: Date: Fri, 30 Mar 2012 08:05:26 -0400 Message-ID: From: David OBrien To: rene7705 CC: php-general Content-Type: multipart/alternative; boundary="_a2faa5e4-22e3-43a0-bdac-8e75e0613505_" Subject: Re: [PHP] securing a script that exec()s X-Mailcontrol-Inbound: GVNsuuuQOypjBowqxnO32Bsgj5bPH0jeWHfdN0Aejb0= X-Scanned-By: MailControl 7.7.0 (www.mailcontrol.com) on 10.65.0.118 Return-Path: php-general-return-317371-adam.nicholls=hl.co.uk@lists.php.net X-MS-Exchange-Organization-OriginalArrivalTime: 30 Mar 2012 12:05:51.1018 (UTC) X-MS-Exchange-Forest-ArrivalHubServer: HLEXCAS01.hargreaveslansdown.co.uk X-MS-Exchange-Organization-OriginalClientIPAddress: 172.16.18.68 X-MS-Exchange-Organization-OriginalServerIPAddress: 10.10.10.81 X-MS-Exchange-Organization-AuthSource: HLEXCAS01.hargreaveslansdown.co.uk X-MS-Exchange-Organization-AuthAs: Anonymous X-MS-Exchange-Organization-MessageDirectionality: Incoming X-MS-Exchange-Organization-Cross-Premises-Headers-Processed: HLEXCAS01.hargreaveslansdown.co.uk X-MS-Exchange-Organization-OriginalSize: 3801 X-MS-Exchange-Forest-MessageScope: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Organization-MessageScope: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Organization-HygienePolicy: Standard X-MS-Exchange-Organization-Recipient-Limit-Verified: True --_a2faa5e4-22e3-43a0-bdac-8e75e0613505_ Content-Type: text/plain; charset="ISO-8859-1" Find a way to do it using PHP's imagemagick extensions http://php.net/manual/en/book.imagick.php On Fri, Mar 30, 2012 at 5:56 AM, rene7705 wrote: > Hi. > > I have a script that uses imagemagick's convert command on the commandline > to get it's work done. > These calls to exec('convert [params]') take params from the end-user via a > html form, so is very unsecure. > > The intention is that the end-user only runs this script on localhost, from > localhost. > > So now i'm checking $_SERVER['REMOTE_ADDR']===$_SERVER['SERVER_ADDR'] to > see if I can allow the script to be used. > > But unfortunately, $_SERVER['REMOTE_ADDR'] is my external IP, and > $_SERVER['SERVER_ADDR'] is my internal IP. > > How would I best fix this? > --_a2faa5e4-22e3-43a0-bdac-8e75e0613505_--