orange08 Posted June 23, 2009 Share Posted June 23, 2009 from the php security written by daniel, i read about this There are a couple of php.ini directives you can use to prevent this: * allow_url_fopen this directive is set to on by default and it controls whether remote files should be includable. * allow_url_include this directive is set to off by default and was introduced in PHP 5.2. It controls whether the include(), require(), include_once() and require_once() should be able to include remote files. In versions below PHP 5.2 this was also controlled by allow_url_fopen. Furthermore, if allow_url_fopen is set to off then this directive will be ignored and set to off as well. so, is that i just need to set in my .htaccess php_flag allow_url_fopen off php_flag allow_url_include off this is all i need to do to handle this security issue? Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/ Share on other sites More sharing options...
flyhoney Posted June 23, 2009 Share Posted June 23, 2009 I think they are off by default. Are you trying to allow or disallow remote file inclusion? Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-862024 Share on other sites More sharing options...
orange08 Posted June 23, 2009 Author Share Posted June 23, 2009 I think they are off by default. Are you trying to allow or disallow remote file inclusion? the 1st one is on by default... for sure want to disallow remote file inclusion, for security purpose... Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-862039 Share on other sites More sharing options...
flyhoney Posted June 23, 2009 Share Posted June 23, 2009 for sure want to disallow remote file inclusion, for security purpose... Yes, you probably do. If it is on and you do not want it on, you are correct, setting it in the .htaccess file is a way to turn it off. If you want to check and make sure it is turned off, you can place <?php phpinfo() ?> in a test.php file and look at it in your browser. This will show you how PHP is configured and you can confirm that the settings in the .htaccess file are being applied correctly. Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-862045 Share on other sites More sharing options...
orange08 Posted June 24, 2009 Author Share Posted June 24, 2009 for sure want to disallow remote file inclusion, for security purpose... Yes, you probably do. If it is on and you do not want it on, you are correct, setting it in the .htaccess file is a way to turn it off. If you want to check and make sure it is turned off, you can place <?php phpinfo() ?> in a test.php file and look at it in your browser. This will show you how PHP is configured and you can confirm that the settings in the .htaccess file are being applied correctly. so, to disallow remote file inclusion, require to set them as 'off', right? because the passage didn't mention about this... so, my question is just to do these setting enough to prevent this attack or not? i did read http://www.phpfreaks.com/tutorial/preventing-remote-file-include-attacks-with-mod-rewrite but, not too understand about it... so, if my setting is enough to handle, then i can skip this part... thanks! Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-862423 Share on other sites More sharing options...
orange08 Posted September 2, 2009 Author Share Posted September 2, 2009 i try to set: php_flag allow_url_fopen off php_flag allow_url_include off in my .htaccess, but allow_url_fopen is failed to set as off...can anyone please tell me what should i do or what's my mistake here...? Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-910678 Share on other sites More sharing options...
PFMaBiSmAd Posted September 2, 2009 Share Posted September 2, 2009 Depending on php version, those two settings can only be set in PHP_INI_SYSTEM, meaning the master php.ini. There is no substitution for validating external data and you cannot rely that any php setting has any particular value or that you will be able to set it on any particular server (your web host can for example prevent you from changing any php settings in a .htaccess file or a local php.ini.) If you are using an external value in an include/require statement, you MUST validate that it only contains expected values. Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-910681 Share on other sites More sharing options...
orange08 Posted September 2, 2009 Author Share Posted September 2, 2009 Depending on php version, those two settings can only be set in PHP_INI_SYSTEM, meaning the master php.ini. There is no substitution for validating external data and you cannot rely that any php setting has any particular value or that you will be able to set it on any particular server (your web host can for example prevent you from changing any php settings in a .htaccess file or a local php.ini.) If you are using an external value in an include/require statement, you MUST validate that it only contains expected values. ok. as a newbie, i have another question here... when i execute <?php phpinfo() ?> and check my phpinfo()... i found there are two columns for each directive, which are local value and master value... can i know what's the different between both? if i set those directives in my .htaccess, both of the columns must get the value i set or only the local value column get the effect? thanks! Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-910683 Share on other sites More sharing options...
PFMaBiSmAd Posted September 2, 2009 Share Posted September 2, 2009 The Master values are set in PHP_INI_SYSTEM (master php.ini or httpd.conf.) The Local values are set by any permitted PHP_INI_PERDIR or PHP_INI_USER settings. The Local values are what are used in a script. Mode Meaning PHP_INI_USER Entry can be set in user scripts (like with ini_set()) or in the Windows registry PHP_INI_PERDIR Entry can be set in php.ini, .htaccess or httpd.conf PHP_INI_SYSTEM Entry can be set in php.ini or httpd.conf PHP_INI_ALL Entry can be set anywhere Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-910686 Share on other sites More sharing options...
orange08 Posted September 2, 2009 Author Share Posted September 2, 2009 The Master values are set in PHP_INI_SYSTEM (master php.ini or httpd.conf.) The Local values are set by any permitted PHP_INI_PERDIR or PHP_INI_USER settings. The Local values are what are used in a script. Mode Meaning PHP_INI_USER Entry can be set in user scripts (like with ini_set()) or in the Windows registry PHP_INI_PERDIR Entry can be set in php.ini, .htaccess or httpd.conf PHP_INI_SYSTEM Entry can be set in php.ini or httpd.conf PHP_INI_ALL Entry can be set anywhere please forgive my ignorant, allow me to confirm again... so, my setting in .htaccess will only affect the value in the column of local value, but won't affect the master value, right? thanks again! Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-910687 Share on other sites More sharing options...
orange08 Posted September 3, 2009 Author Share Posted September 3, 2009 The Master values are set in PHP_INI_SYSTEM (master php.ini or httpd.conf.) The Local values are set by any permitted PHP_INI_PERDIR or PHP_INI_USER settings. The Local values are what are used in a script. Mode Meaning PHP_INI_USER Entry can be set in user scripts (like with ini_set()) or in the Windows registry PHP_INI_PERDIR Entry can be set in php.ini, .htaccess or httpd.conf PHP_INI_SYSTEM Entry can be set in php.ini or httpd.conf PHP_INI_ALL Entry can be set anywhere please forgive my ignorant, allow me to confirm again... so, my setting in .htaccess will only affect the value in the column of local value, but won't affect the master value, right? thanks again! is that i'm wrong? Quote Link to comment https://forums.phpfreaks.com/topic/163377-remote-file-inclusion/#findComment-911377 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.