note 79806 added to security.globals
| From: | Tumasch at osu1 dot php dot net | Date: | Thu, 13 Dec 2007 13:50:47 +0000 |
| Subject: | note 79806 added to security.globals | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-133422@lists.php.net to get a copy of this message | ||
In addition to Mike Willbanks post:
Put this to the beginning of every file or to a functions.inc.php and call it every time before
start working with user variables.
This will prevent problems with wrong initalized variables or users who try to break your
application.
And this has an extra bonus: Applications which still work are also register_globasl = off enabled!
<?php
//
// If register_globals is on, delete all variables exept the ones in the array
//
if (ini_get('register_globals')) {
foreach ($GLOBALS as $int_temp_name => $int_temp_value) {
if (!in_array($int_temp_name, array (
'GLOBALS',
'_FILES',
'_REQUEST',
'_COOKIE',
'_SERVER',
'_ENV',
'_SESSION',
ini_get('session.name'),
'int_temp_name',
'int_temp_value'
))) {
unset ($GLOBALS[$int_temp_name]);
}
}
}
//
// Now, (re)import the variables
//
if (isset ($_REQUEST['pass']))
$ext_pass = $_REQUEST['pass'];
if (isset ($_REQUEST['user']))
$ext_user = $_REQUEST['user'];
if (isset ($_REQUEST['action']))
$ext_action = $_REQUEST['action'];
//
// Cleanup entries
//
$int_pass = (isset ($ext_pass) ? preg_replace("'[^A-Z]'", "",
$ext_pass) : '');
$int_user = (isset ($ext_user) ?
preg_replace("'[]A-Za-z0-9áäà âãëèéêïìîóöòôõúüùû
\.^\$\!\_-()'", "", $ext_user) : '');
$int_action = (isset ($ext_action) ? intval($ext_action) : '');
//
// Import Session variables
//
if (isset ($_SESSION)) {
foreach ($_SESSION as $int_temp_key => $int_temp_value) {
if ($int_temp_value != '') {
$$int_temp_key = $int_temp_value;
}
}
}
//
// Import Cookie variables
//
if (isset ($_COOKIE)) {
foreach ($_COOKIE as $int_temp_key => $int_temp_value) {
if ($int_temp_value != '') {
$$int_temp_key = $int_temp_value;
}
}
}
//
// From here on, work only with $int_ variables and you're safe!
//
?>
With this you can prevent a lot of different problems!
----
Server IP: 194.153.94.10
Probable Submitter: 194.40.201.2
----
Manual Page -- http://www.php.net/manual/en/security.globals.php
Edit -- https://master.php.net/note/edit/79806
Del: integrated -- https://master.php.net/note/delete/79806/integrated
Del: useless -- https://master.php.net/note/delete/79806/useless
Del: bad code -- https://master.php.net/note/delete/79806/bad+code
Del: spam -- https://master.php.net/note/delete/79806/spam
Del: non-english -- https://master.php.net/note/delete/79806/non-english
Del: in docs -- https://master.php.net/note/delete/79806/in+docs
Del: other reasons-- https://master.php.net/note/delete/79806
Reject -- https://master.php.net/note/reject/79806
Search -- https://master.php.net/manage/user-notes.php