Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #10040

Re: Help with Security Have I coded this correctly?

Show all headers | View raw

On 7/8/2013 4:49 AM, kishorguru99pvtltd@gmail.com wrote:
> On Thursday, July 4, 2013 12:05:09 AM UTC+5:30, Christoph Michael Becker wrote:
>> Daniel Pitts wrote:
>>
>>> On 7/2/13 11:50 PM, chirag sharma wrote:
>>
>>>> I have created an online PHP code executor at http://web.guru99.com
>>
>>>>
>>
>>>> Though I have checked all security aspects � do you experts see any
>>
>>>> major flaw that I need to care of?
>>
>>>>
>>
>>> I get a 403 forbidden on the AJAX request in both Chrome and Firefox.
>>
>>>
>>
>>> I don't know what you've done to protect against attack. Are you safe
>>
>>> against the following type of attack? Are you just scrubbing the input,
>>
>>> or have you actually locked-down and hardened the PHP itself?
>>
>>>
>>
>>> <?php
>>
>>> $foo = "scan";
>>
>>> $foo .= "dir";
>>
>>>
>>
>>> var_dump($foo('.'));
>>
>>> ?>
>>
>>
>>
>> When the AJAX request did work (about an hour ago), I was able to
>>
>> execute the following successfully:
>>
>>
>>
>> <?php
>>
>> print_r(glob("*"));
>>
>> ?>
>>
>>
>>
>> --
>>
>> Christoph M. Becker
>> Thanks for reply
> if  disable "glob()" function  it can be solve.
>

What you don't understand is - that will solve THIS problem.  But how 
many other potential security risks do you have?

There are huge risks when allowing people to place code on your system. 
  Securing your system is much more than just disabling a few functions.


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Help with Security  Have I coded this correctly? chirag sharma <chiragsharma.guru99@gmail.com> - 2013-07-02 23:50 -0700
  Re: Help with Security  Have I coded this correctly? Arno Welzel <usenet@arnowelzel.de> - 2013-07-03 17:05 +0200
  Re: Help with Security  Have I coded this correctly? Twayne <nobody@spamcop.net> - 2013-07-03 12:31 -0400
    Re: Help with Security  Have I coded this correctly? Arno Welzel <usenet@arnowelzel.de> - 2013-07-09 16:20 +0200
  Re: Help with Security  Have I coded this correctly? Timothy <timothy@nospam.tld> - 2013-07-03 17:42 +0000
  Re: Help with Security  Have I coded this correctly? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-07-03 19:52 +0200
  Re: Help with Security  Have I coded this correctly? Daniel Pitts <newsgroup.nospam@virtualinfinity.net> - 2013-07-03 11:12 -0700
    Re: Help with Security  Have I coded this correctly? Christoph Michael Becker <cmbecker69@arcor.de> - 2013-07-03 20:35 +0200
      Re: Help with Security  Have I coded this correctly? kishorguru99pvtltd@gmail.com - 2013-07-08 01:49 -0700
        Re: Help with Security  Have I coded this correctly? Jerry Stuckle <jstucklex@attglobal.net> - 2013-07-08 08:48 -0400

csiph-web