note 61265 deleted from function.highlight-file by bjori

Note Submitter: contact at soulpass dot com ---- I wanted to have a provision for highlighting source files that I have written. I also wanted people to be able to see the highlighted files from links on my blog (i.e. - the general public would be exposed to this as well). Using highlight_string() would require me to update a second file every time I update the original script, but using highlight_file() brings up a major security risk! I made the following code that goes at the top of highlighting script. Note that if you want to enable highlighting of a particular file, you'll have to add its path to a text file, as described below. <?php if (!isset($_GET['f']) || !file_exists($_GET['f'] . '.php') || !in_array($_GET['f'], array_map('trim', file('valid_files.txt'))) || preg_match('(^/|\\./)', $_GET['f']) || $_GET['f'] == 'index') { exit('Message to malicious visitor.'); } ?> This just serves to keep people from trying to highlight files below the current directory (in my case, /source/). After this snippet, you could put some simple highlighting code that highlights the file using highlight_file($_GET['f'] . '.php'); Since I have the highlighting script saved as "index.php," in my case the script is called with /source/index.php?f=path/to/file Notice that there is no .php extension. With this script, it appends ".php" automatically, thus effectively disallowing any file other than a PHP file to be highlighted (i.e., no .htaccess file will be highlighted on accident). The script also aborts if it detects a leading forward slash (/), or a period followed by a forward slash (./) anywhere in the requested file. I couldn't think of a case where ./ would be a valid request, but I could be wrong there. Also note that a file called "valid_files.txt" goes in the same directory as the highlighting script. The format of this file is as follows: path/to/file1 path/to/file2 Note that there is no extension here either because PHP is assumed in the script. Finally, the script does not allow _itself_ to be highlighted. That's where "|| $_GET['f'] == 'index'" comes in. In case a security risk has not been covered here, we don't want anyone to see the measures, or lack thereof, that have been covered. If you want to use an .htaccess file to clean up the URL, here's an idea for that: <IfModule mod_rewrite.c> RewriteEngine On RewriteRule ^(.+).phps$ index.php?f=$1 [L] </IfModule> The .htaccess file goes in the same directory as the highlighting script (again, in my case, /source/). With it, the script may be called with this URI: /source/path/to/file.phps This also adds another security benefit, as people may now see that the files appears to be ending in .phps. I know it's a bit messy, but it's also a big deal to have the script as secure as possible. If anyone has any suggestions, please post them.