Re: Security check
| From: | Rasmus Lerdorf | Date: | Wed, 01 Jun 2005 20:33:15 +0000 |
| Subject: | Re: Security check | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-216175@lists.php.net to get a copy of this message | ||
Andy Pieters wrote:
> $valid=array('from','authorize','order');
> #copy GET to POST
> if(count($_GET)>0)
> {foreach($_GET as $key=>$value)
> if(in_array($key,$valid))
> {$key=htmlspecialchars($key);
> $value=htmlspecialchars($value);
> $hiddens.=<<<___hid
> <input type="hidden" name="$key" value="$value">\n\t
> ___hid;
> }
> }
Ok, you are cleaning your input data nicely here.
> elseif(count($_POST)>0)
> foreach($_POST as $key=>$value)
> if( ($key!=='login') && ($key!=='name') &&
> ($key!=='pass') )
> $hiddens.=<<<_hid_
> <input type="hidden" name="$key" value="$value">\n\t
> _hid_;
But what happened here? Why do you assume POST data is safe?
> if( (array_key_exists('savereferer',$_GET)) &&
> ($_GET['savereferer']=='yes'))
> {safeReferer($ref,$chksum);
> $hiddens.=<<<_ref_
> <input type="hidden" name="referer" value="$ref">\t
> \t<input type="hidden" name="checksum" value="$chksum">
> _ref_;
> }
I don't see where $ref comes from. I am assuming it somehow trickles
down from HTTP_REFERER? If so, did you clean it?
-Rasmus