Re: securing a script that exec()s
| From: | Bastien | Date: | Fri, 30 Mar 2012 12:01:30 +0000 |
| Subject: | Re: securing a script that exec()s | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-317370@lists.php.net to get a copy of this message | ||
Bastien Koert
On 2012-03-30, at 5:56 AM, rene7705 <rene7705@gmail.com> wrote:
> Hi.
>
> I have a script that uses imagemagick's convert command on the commandline
> to get it's work done.
> These calls to exec('convert [params]') take params from the end-user via a
> html form, so is very unsecure.
>
> The intention is that the end-user only runs this script on localhost, from
> localhost.
>
> So now i'm checking $_SERVER['REMOTE_ADDR']===$_SERVER['SERVER_ADDR']
> to
> see if I can allow the script to be used.
>
> But unfortunately, $_SERVER['REMOTE_ADDR'] is my external IP, and
> $_SERVER['SERVER_ADDR'] is my internal IP.
>
> How would I best fix this?
Validate the data?