RE: [PHP] slight quik question

wicked yeh thats even etter , i didnt even know u could use passthru like that -----Original Message----- From: John Coggeshall [mailto:john@coggeshall.org] Sent: Monday, April 07, 2003 6:35 PM To: 'Dan Rossi'; 'Leif K-Brooks'; 'Martin Towell' Cc: php-general@lists.php.net Subject: RE: [PHP] slight quik question >i guess i could chroot it ?, i'ver had a similar story when >doing a file diretory viewer and giving the dir in the query >string, i managed to chroot it to a top directory only, was >scary u could go all the way to / The single most important security rule you should be consider when working with PHP (or anything really, for that matter)... Never trust user input. >>if (file_exists("path/to/file/$name")) >> passthru("path/to/file/$name"); >>else >> passthru("path/to/file/nofile_image.gif"); >>?> Something like... $filename = basename($_GET['name']); $filepath = "path/to/files/$filename"; if(file_exists($filepath)) { .... Is much better... This way the script cannot be tricked into grabbing a file from a different directory, since basename() will strip any directory information from the user input. Also, passthru() executes a command.. Something like: header("Content-Type: image/gif"); $fr = fopen($filepath, 'r'); fpassthru($fr); fclose($fr); Would dump the image to the browser... However, that means you'll need to know the proper MIME content type... Just a few thoughts for you. - John -~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~- John Coggeshall john at coggeshall dot org http://www.coggeshall.org/ -~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~--~=~- >-----Original Message----- >From: Dan Rossi [mailto:daniel@electroteque.org] >Sent: Monday, April 07, 2003 4:26 AM >To: Leif K-Brooks; Martin Towell >Cc: php-general@lists.php.net >Subject: RE: [PHP] slight quik question > > >i guess i could chroot it ?, i'ver had a similar story when >doing a file diretory viewer and giving the dir in the query >string, i managed to chroot it to a top directory only, was >scary u could go all the way to / > >-----Original Message----- >From: Leif K-Brooks [mailto:eurleif@buyer-brokerage.com] >Sent: Monday, April 07, 2003 6:00 PM >To: Martin Towell >Cc: 'daniel'; php-general@lists.php.net >Subject: Re: [PHP] slight quik question > > >Be careful with that, a hacker could use it to gain access to >sensitve files. Feeding it a name like "../foo/bar", for >example, would provide access to path/to/foo/bar. > >Martin Towell wrote: > >>something like: >> >>URL: http://site.com/get_image.php?name=image_name_here.jpg >> >>SRC: >><? >>if (file_exists("path/to/file/$name")) >> passthru("path/to/file/$name"); >>else >> passthru("path/to/file/nofile_image.gif"); >>?> >> >>(you'll need to check the spelling of passthru... maybe it's >readfile() >>- >or >>something...) >> >>-----Original Message----- >>From: daniel [mailto:daniel@electroteque.org] >>Sent: Monday, April 07, 2003 12:00 PM >>To: php-general@lists.php.net >>Subject: [PHP] slight quik question >> >> >>hi guys i have been working on a photo gallery script for >some time now >>, i have some issues i may need help with , i have public and private >>galleries i am setting up , although the images are stored in the >>document directory >and >> >>would still be viewable by accessing them directly instead of the >>gallery script , how would it be possible to store the images outside >>the web path and be viewable in the page without having to >use gd to do >>it ? >> >> >> >> >> > >-- >The above message is encrypted with double rot13 encoding. >Any unauthorized attempt to decrypt it will be prosecuted to >the full extent of the law. > > > > >-- >PHP General Mailing List (http://www.php.net/) >To unsubscribe, visit: http://www.php.net/unsub.php > > >-- >PHP General Mailing List (http://www.php.net/) >To unsubscribe, visit: http://www.php.net/unsub.php > > -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php