note 109926 added to security.filesystem
| From: | lehal2 at hotmail dot com | Date: | Mon, 03 Sep 2012 14:38:23 +0000 |
| Subject: | note 109926 added to security.filesystem | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-190457@lists.php.net to get a copy of this message | ||
After big hard work i made this whitelist file security script .I like to share with you so that you
can save time and avoid any hack attempts.
function WhitePage($page){
$info2 = apache_lookup_uri('src/index.php?p='.$page);
list($arg,$val)= explode("=", $info2->args);
$myrequest=basename(htmlspecialchars_decode($val));
return $myrequest;
}
function read_dir($dir, $array = array()){
$dh = opendir($dir);
$files = array();
while (($file = readdir($dh)) !== false) {
$flag = false;
if($file !== '.' && $file !== '..' &&
!in_array($file, $array)) {
$files[] = trim($file);
}
}
return $files;
}
function whitelist($page=null){
$info2 = apache_lookup_uri('../../src/index.php?p='.$page);
list($arg,$val)= explode("=", $info2->args);
// basename from the std class
$myrequest=basename(htmlspecialchars_decode($val));
$myrequest=trim($myrequest.'.php');
//pathinfo from the std class
$path= pathinfo($info2->filename);
// get the files array
$whitefiles = read_dir($path['dirname']);
if (in_array($myrequest,$whitefiles, true)){
$res= 1;
}else{
$res= 0;
}
return $res;
}
// this is solution of this kind of the problems
//$p='index.php?p=../../../../../../../../etc/passwd%00index.html';
$p='../../../../../../../../etc/passwd%00index.html';
$p= WhitePage($p);
$result= WhiteList($p);
if ($result){
echo 'ok';
}else{
echo 'Die ,You evil hacker';
}
----
Server IP: 69.147.83.197
Probable Submitter: 86.146.235.236
----
Manual Page -- http://www.php.net/manual/en/security.filesystem.php
Edit -- https://master.php.net/note/edit/109926
Del: integrated -- https://master.php.net/note/delete/109926/integrated
Del: useless -- https://master.php.net/note/delete/109926/useless
Del: bad code -- https://master.php.net/note/delete/109926/bad+code
Del: spam -- https://master.php.net/note/delete/109926/spam
Del: non-english -- https://master.php.net/note/delete/109926/non-english
Del: in docs -- https://master.php.net/note/delete/109926/in+docs
Del: other reasons-- https://master.php.net/note/delete/109926
Reject -- https://master.php.net/note/reject/109926
Search -- https://master.php.net/manage/user-notes.php