Jump to content


Photo

Security problem


  • Please log in to reply
4 replies to this topic

#1 OLM3CA

OLM3CA
  • Members
  • PipPipPip
  • Advanced Member
  • 52 posts
  • LocationCyprus

Posted 26 August 2006 - 12:14 PM

Hello
I have some questions about the security of my page.
I have included pages in index.php  IE:main.php upper.php footer.php  etc ...
When I click www......com/main.php or com/upper.php  It appears but I dont want this page to shown by the users.İf so  redirect user to the index.php

And the other question is : Yesterday when i click my URL appears a box showing to save the file ?
ı was shocked and type other pages ex: connection.php  I see that i am able to save and view the passwords and codes of the page! What happened ?

And the last question is is there a prepared .htaccess security file that contains all security information.?
AMD rather than Intel , PHP rahter than ASP

#2 shocker-z

shocker-z
  • Members
  • PipPipPip
  • Advanced Member
  • 864 posts
  • LocationNottingham

Posted 26 August 2006 - 12:24 PM

1. You could set a variably in your template and then check if that is set in the included file > also can be done in the way of set a session in your template file $_SESSION['include']='yes'; and then in the include file use

if ($_SESSION['include'] == 'yes') {
//all your include code 
$_SESSION['include']='no';
} else {
echo 'no direct access to this file';
}
this will mean that your included page will unset the session and therefore can't be accessed or a less the session has been set.

2. you seem to have a problem with your MIME types if you are able to download the php file as source.

regards
Liam
www: www.ukchat.ws | irc: irc.ukchat.ws chan: #blufudge

#3 Orio

Orio
  • Staff Alumni
  • Advanced Member
  • 2,491 posts

Posted 26 August 2006 - 12:27 PM

Question 1:
when you include the file include it this way-
include("upper.php?code=123987555");

Now upper.php will look like this:
<?php
if(isset($_GET['code']) && $_GET['code']=="123987555"){
//do what the included file should do
}else{
echo("No direct Access here");
}
?>


The problem with shocker-z's code is that after you visit the template once you can access the included file directly (because the session variable is set to "yes").

Orio.
Think you're smarty?

(Gone until 20 to November)

#4 shocker-z

shocker-z
  • Members
  • PipPipPip
  • Advanced Member
  • 864 posts
  • LocationNottingham

Posted 26 August 2006 - 12:35 PM

The problem with shocker-z's code is that after you visit the template once you can access the included file directly (because the session variable is set to "yes").

no because if it is set as yes then we set it to 'no' so it will only work that once.. never thought of using GET actualy because i was thinking that would be shown forgetting it would be passed..

would you not have to use

include("http://domain.com/up...code=123987555");

?? else it's not parsing it thru http server
www: www.ukchat.ws | irc: irc.ukchat.ws chan: #blufudge

#5 OLM3CA

OLM3CA
  • Members
  • PipPipPip
  • Advanced Member
  • 52 posts
  • LocationCyprus

Posted 26 August 2006 - 12:38 PM

so what would I do ? :)
and Do I have to change .htaccess for security ?ı have done nothing with that it says origianally.
AMD rather than Intel , PHP rahter than ASP




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users