Jump to content

Submit file and echo


newbtophp

Recommended Posts

I'm trying to submit a php file, which will then echo the html output (browser view source) of the submitted php file.

 

The trouble is I can't get the html output inside the textarea (html source = when the $file is run > browser > view source.)

 

<form method="post" action="<?php echo $PHP_SELF;?>" enctype="multipart/form-data">
<input type="file" name="code" value="Upload" /> 
<input name="submit" type="submit" value="code" />
<br />

<?php

if (isset($_FILES['code'])) {
$file = file_get_contents($_FILES['code']['tmp_name']);

echo '<form>
<textarea style="width:100%; height:300px;">'.$file.'</textarea></form>';
}
?>

 

Thanks

Link to comment
Share on other sites

Thanks, I've tried that, but that just reacts the same with or without them,

 

So I've come up with this:

 

<form method="post" action="<?php echo $PHP_SELF;?>" enctype="multipart/form-data">
<input type="file" name="code" value="Upload" /> 
<input name="submit" type="submit" value="code" />
<br />

<?php

if (isset($_FILES['code'])) {
$file = file_get_contents($_FILES['code']['tmp_name']);

echo '<form>';
$fil = "lol.php";
$fp = fopen($fil,"w");
fwrite($fp,$file);
fclose($fp);
$url = "http://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
$filenew = file_get_contents($url."lol.php");
echo '<br><textarea style="width:100%; height:300px;">'.htmlspecialchars($filenew).'</textarea>';
unlink($fil);
}
?>

 

When I upload a php file, it views the html source in the text area, but if the uploaded php file contains includes/requires then it reacts as if the file is hosted on my site, the html output gives errors like:

 

<b>Warning</b>:  include(SITE/text.txt) [<a href='function.include'>function.include</a>]: failed to open stream: No such file or directory in <b>some site</b> on line <b>1</b><br />

Link to comment
Share on other sites

you don't want he URL to the file, you want the local file system path (which is $fil). by using the full URL it's actually getting it through the web, and since it's a PHP file, your webserver is processing it:

 

<form method="post" action="<?php echo $PHP_SELF;?>" enctype="multipart/form-data">
<input type="file" name="code" value="Upload" /> 
<input name="submit" type="submit" value="code" />
<br />

<?php

if (isset($_FILES['code'])) {
$fil = "lol.php";
move_uploaded_file($_FILES['code']['tmp_name'],$fil);

echo '<form>';
$filenew = file_get_contents($fil);
echo '<br><textarea style="width:100%; height:300px;">'.htmlspecialchars($filenew).'</textarea>';
unlink($fil);
}
?>

Link to comment
Share on other sites

So...you want the PHP in the file parsed? If I upload the following file:

This is the date: <?php echo date('r'); ?>
This is the server: <?php echo $_SERVER['SERVER_NAME']; ?>

You want that text in the textarea to be:

This is the date: Fri, 17 Jul 2009 12:52:00 -0400
This is the server: www.yourservername.com

??

Link to comment
Share on other sites

So...you want the PHP in the file parsed? If I upload the following file:

This is the date: <?php echo date('r'); ?>
This is the server: <?php echo $_SERVER['SERVER_NAME']; ?>

You want that text in the textarea to be:

This is the date: Fri, 17 Jul 2009 12:52:00 -0400
This is the server: www.yourservername.com

??

 

Yep thats exactly what I mean  :D (sorry for my bad explanation)

Link to comment
Share on other sites

First off...this is a HUGE (and by HUGE I mean HUGE) security risk. You are allowing anyone to put PHP code on your server and run it. They could delete files, steal information, do pretty much anything.

 

That being said, the way you are doing it with the URL would work, so would using eval(). But you will always have a problem with includes. Keep on your example basis, what should the output of the following look like if I uploaded it:

<?php
  require_once('config.php');
  echo $config['foobar'];
?>
This is the date: <?php echo date('r'); ?>
This is the server: <?php echo $_SERVER['SERVER_NAME']; ?>

Link to comment
Share on other sites

I understand about the security risk (I will password protect the page, for personal use).

 

<?php
  require_once('config.php');
  echo $config['foobar'];
?>
This is the date: <?php echo date('r'); ?>
This is the server: <?php echo $_SERVER['SERVER_NAME']; ?>

 

Would be:

 

<?php
  require_once('config.php');
  echo $config['foobar'];
?>
This is the date: Fri, 17 Jul 2009 12:52:00 -0400
This is the server: www.yourservername.com

 

Heres another example:

 

<?php
echo "<html>\n"; 
echo "<title>PHPFreaks is Helpful</title>\n";
?>

 

Would be:

 

<html>
<title>PHPFreaks is Helpful</title>

 

 

Generally all php is not shown, but for includes/requires they are added to the output (to prevent error messages and such).

Link to comment
Share on other sites

parse the HTML? Just echo the contents inside a div without htmlspecialchars()

 

can you back up and just explain what you are trying to accomplish with this? there might be a better/easier way that we are missing

Link to comment
Share on other sites

Ok, I have come up with the code, the form (index.php) executes the inserted code (php) to run.php, and the submit.php pulls the html from run.php.

 

It all works, except their is alot of security risks, its also not userfriendly.

 

For example:

 

1. If no code is submitted , the submit button can still proceed. (Is their a way to do form validation)

 

2. If code dont get processed correctly it will show whats currently on run.php. (Its their a way to delete whats placed within run.php everytime, a visitors navigates a way from the page)

 

3. Visitors can enter anything within the form (is their a way to validate it by, making sure it contains code ie. by checking if it contains php tags or something).

 

 

Is it possible you can reply with an improved and more sanitized version of the code? (security wise aswell as userability)

 

index.php:

 

<?
if(isset($_POST["submit"]))
{
	echo "<br>Loading...<br>";
echo '<meta http-equiv="refresh" content="1; url = submit.php" />';
}
?>
<BR>


<form action='index.php' method='post'>
<input type="file" name="o" value="Upload" /> 
<input name="submit" type="submit" value="code" />
<BR><BR>

</form>


<?php

if(!empty($_POST["submit"]))
{
$out='<?php
$o="'. (isset($_POST["o"])? $_POST["o"]:'') .'";
?>';
file_put_contents("run.php",$out);
}
?></span>
<br>

 

 

submit.php

 

<?php

header('Content-Type: text/plain');
$website = "run.php";
$info = file_get_contents($website);
header('Content-Type: text/html');
echo "<center><textarea name=\"output\" cols=80 rows=20>$info</textarea>\n \n"; 
echo "</center>\n";
?>

 

run.php

 

This is the file the form is executing too

 

Thanks

Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.