Re: something works 1 place but not another

On 24 Dec, 23:48, Dave Kelly <daveekel...@xxxxxxxxxxxxxx> wrote:
On Dec 24, 7:10 am, Jerry Stuckle <jstuck...@xxxxxxxxxxxxx> wrote:



Dave Kelly wrote:
On Dec 23, 3:33 pm, Jerry Stuckle <jstuck...@xxxxxxxxxxxxx> wrote:
Dave Kelly wrote:
Please go here for source code.
http://www.texasflyfishers.org/signup/guestbookwithouting.php?mode=vi...
This line of code works as I want it to in the first instance:
<p><b>Trip</b>: $var1</p>
In the second instance ( which I have commented out ) the screen goes
blank.
Why? What is the dirrerence?
Yes I know there is a line of sensitive information visible.
Thanks
Dave
You need a password to access that page.

Sorry guys, I forgot about that. Let me post the whole code here, its
not that long.
<?php

/********************************************
 * Simple PHP Guestbook                     *
 * by Justin                                *
 * Version 1.0                              *
 * 2003-Feb-01                              *
 * Works with PHP version 4.1.0 and higher  *
 ********************************************/

/********************************************
 * CHANGE THIS to the file you want         *
 * to store all the info in.                *
 * Make sure the file exists                *
 * and is CHMODed to 777                    *
 ********************************************/
foreach ($_POST as $key=>$value) {
   $$key=$value;
}
foreach ($_GET as $key=>$value) {
   $$key=$value;
}

<snip>

In addition to what the others have said, this is very dangerous code.
It allows the user to define any variable in your code.  It's a huge
security risk.

register_globals did basically the same thing, but has been deprecated
due to those same security

I am asking this question because I do not fully understand. I
understand 'dangerous code' and 'security risk' and have a vague
knowledge of what 'register_globals' might be. Though I don't know one
from an earth worm.

This file is called from the HTML pages.

<a ref="http://www.texasflyfishers.org/signup/guestbook.php?
mode=view&var1=SALTWATER-RedFishRodeo-Oct">sign up here</a>

'signup'is the user name/password protect directory you ran into from
my first post. Does that still leave me as vulnerable?

I guess one of the things I need to ask, is there somewhere I can read
that explains the security of such things as register_globals in
laymans terms.

Despite what I might say, I do appreciate the critique and feedback.
Thanks

Whilst just as dangerous, you can replace:
foreach ($_POST as $key=>$value) {
$$key=$value;
}

with:
extract($_POST);

And to make it slightly safer, you could then do:
extract($_POST,EXTR_PREFIX_ALL,'slightly_safer');

And EXTR_IF_EXISTS also helps improve safety.
You can find explanations of all this at:
http://uk.php.net/manual/en/function.extract.php

Now, as to your request:
I guess one of the things I need to ask, is there somewhere I can read
that explains the security of such things as register_globals in
laymans terms.
The answer I'm afraid is that there is no substitute for experience,
research and study. Just google for things like "php security" and
"php injection" and read read read...
.

Relevant Pages

  • Re: something works 1 place but not another
    ... This line of code works as I want it to in the first instance: ... Works with PHP version 4.1.0 and higher * ... foreach { ... Don't the two foreach loops above with the variable variables already ...
    (comp.lang.php)
  • Re: something works 1 place but not another
    ... This line of code works as I want it to in the first instance: ... Works with PHP version 4.1.0 and higher * ... foreach { ... It's a huge security risk. ...
    (comp.lang.php)
  • Re: something works 1 place but not another
    ... This line of code works as I want it to in the first instance: ... In the second instance the screen goes ... Works with PHP version 4.1.0 and higher * ... foreach { ...
    (comp.lang.php)
  • TSLSA-2005-0059 - multi
    ... Affected versions: Trustix Secure Linux 2.2 ... PHP is an HTML-embedded scripting language. ... use of Rest with FTP servers and Range with HTTP servers to retrieve files ... - New Upstream and Multiple Vendor Security Fixes ...
    (Bugtraq)
  • [NT] Phusion Webserver File Viewing, DoS and Arbitrary Code Execution Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Phusion Webserver Server is an Webserver ... execute arbitrary commands. ... foreach $line { ...
    (Securiteam)
Loading