Note exposing possible sensitive information
| From: | Christopher Harrington | Date: | Fri, 17 Oct 2003 17:07:54 +0000 |
| Subject: | Note exposing possible sensitive information | ||
| Groups: | php.doc | ||
| Request: | Send a blank email to phpdoc+get-969356636@lists.php.net to get a copy of this message | ||
I wanted to let you guys know that I came across someone foolishly giving up their account number and password in a note on the curl_setopt page. ( http://us3.php.net/manual/en/function.curl-setopt.php ) The excerpt is as follows...
$apayment = new APayments;
-----------------------------
You can use it this way:
$data = Array();
$data["AccountID"] = 24883;
$data["PassPhrase"] = urlencode(base64_decode("a2sxOTcx"));
$data["Payee_Account"] = 43892;
$data["Amount"] = number_format("10.329842", 2);
$data["Memo"] = urlencode(stripslashes("Automatic Payment"));
$data["PAY_IN"] = 1;
$data["WORTH_OF"] = "Gold";
$data["IGNORE_RATE_CHANGE"] = "Y";
$apayment->Pay($data);
echo $apayment->PROCES_DETAILS["Error"]; // possible error
echo $apayment->PROCES_DETAILS["Batch"]; // batch nr
I'd hate to see someone abuse this information. Could a documentation editor conceal the sensitive bits (AccountID and PassPhrase) so this person contributing very useful code doesn't end up having his account hijacked?
Thanks...
-Christopher Harrington