svn: /phpdoc/en/trunk/reference/mongo/ manual.xml mongodate.xml security.xml trouble.xml

kristina Thu, 29 Jul 2010 21:58:57 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=301704 Log: added some security info Changed paths: U phpdoc/en/trunk/reference/mongo/manual.xml U phpdoc/en/trunk/reference/mongo/mongodate.xml A phpdoc/en/trunk/reference/mongo/security.xml U phpdoc/en/trunk/reference/mongo/trouble.xml Modified: phpdoc/en/trunk/reference/mongo/manual.xml =================================================================== --- phpdoc/en/trunk/reference/mongo/manual.xml 2010-07-29 21:57:47 UTC (rev 301703) +++ phpdoc/en/trunk/reference/mongo/manual.xml 2010-07-29 21:58:57 UTC (rev 301704) @@ -10,6 +10,7 @@ &reference.mongo.connecting; &reference.mongo.queries; &reference.mongo.updates; + &reference.mongo.security; &reference.mongo.testing; &reference.mongo.trouble; Modified: phpdoc/en/trunk/reference/mongo/mongodate.xml =================================================================== --- phpdoc/en/trunk/reference/mongo/mongodate.xml 2010-07-29 21:57:47 UTC (rev 301703) +++ phpdoc/en/trunk/reference/mongo/mongodate.xml 2010-07-29 21:58:57 UTC (rev 301704) @@ -31,6 +31,13 @@ ?> ]]> </programlisting> + <para> + MongoDB stores dates as milliseconds past the epoch. This means that dates + <emphasis>do not</emphasis> contain timezone information. Timezones must be + stored in a separate field if needed. Second, this means that any precision + beyond milliseconds will be lost when the document is sent to/from the + database. + </para> </section> <!-- }}} --> Added: phpdoc/en/trunk/reference/mongo/security.xml =================================================================== --- phpdoc/en/trunk/reference/mongo/security.xml (rev 0) +++ phpdoc/en/trunk/reference/mongo/security.xml 2010-07-29 21:58:57 UTC (rev 301704) @@ -0,0 +1,63 @@ +<?xml version="1.0" encoding="utf-8"?> +<!-- $Revision$ --> + +<section xml:id="mongo.security" xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink"> + <title>Security</title> + + <section> + <title>Request Injection Attacks</title> + <para> + If you are passing <literal>$_GET</literal> parameters to your queries, make + sure that they are cast to strings first. Users can insert associative + arrays in GET requests, which could then become unwanted $-queries. + </para> + + <para> + A fairly innocuous example: suppose you are looking up a user's information + with the request <emphasis>http://www.example.com?username=bob</emphasis>. + Your application does the query + <literal>$collection->find(array("username" => $_GET['username']))</literal>. + </para> + + <para> + Someone could subvert this by getting + <emphasis>http://www.example.com?password[$in]=foo</emphasis>, which PHP + will magically turn into an associative array, turning your query into + <literal>$collection->find(array("username" => array('$ne' => "foo")))</literal>, + which will return all users not named "foo" (all of your users, probably). + </para> + + <para> + This is a fairly easy attack to defend against: make sure $_GET's parameters + are the type you expect before you send them to the database (cast them to + strings, in this case). + </para> + + <para> + Thanks to <link xlink:href="&url.mongodb.injection;">Phil</link> for pointing this out. + </para> + </section> + +</section> + +<!-- Keep this comment at the end of the file +Local variables: +mode: sgml +sgml-omittag:t +sgml-shorttag:t +sgml-minimize-attributes:nil +sgml-always-quote-attributes:t +sgml-indent-step:1 +sgml-indent-data:t +indent-tabs-mode:nil +sgml-parent-document:nil +sgml-default-dtd-file:"~/.phpdoc/manual.ced" +sgml-exposed-tags:nil +sgml-local-catalogs:nil +sgml-local-ecat-files:nil +End: +vim600: syn=xml fen fdm=syntax fdl=2 si +vim: et tw=78 syn=sgml +vi: ts=1 sw=1 +--> + Property changes on: phpdoc/en/trunk/reference/mongo/security.xml ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Date LastChangedDate LastChangedRevision Author LastChangedBy HeadURL URL Modified: phpdoc/en/trunk/reference/mongo/trouble.xml =================================================================== --- phpdoc/en/trunk/reference/mongo/trouble.xml 2010-07-29 21:57:47 UTC (rev 301703) +++ phpdoc/en/trunk/reference/mongo/trouble.xml 2010-07-29 21:58:57 UTC (rev 301704) @@ -32,6 +32,28 @@ </listitem> </itemizedlist> + <para> + You can turn on (very) verbose debugging output by compiling the driver with + the debugging flag. + </para> + <programlisting> +<![CDATA[ +$ ./configure CFLAGS=-DDEBUG +]]> + </programlisting> + <para> + <literal>DEBUG</literal> turns on all debugging. You can also turn on + specific debug flags. In the latest code, these flags are: + <itemizedlist> + <listitem> + <para>DEBUG_CONN</para> + <para> + Debugging connections. + </para> + </listitem> + </itemizedlist> + </para> + </section> <!-- Keep this comment at the end of the file