Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #12759 > unrolled thread

Nested PHP

Back to article view | Back to comp.lang.php

Contents

  Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-10 20:24 +0000
    Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 15:56 -0500
      Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-10 21:44 +0000
        Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 16:51 -0500
          Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-11 08:14 -0600
            Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 09:27 -0500
              Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-11 18:41 -0600
                Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 20:03 -0500
                  Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 10:13 +0000
                    Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-12 10:33 +0000
                    Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-12 06:30 -0500
                      Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 12:52 +0000
                        Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-02-12 13:11 +0000
                        Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-13 06:55 +0000
                          Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-02-13 12:02 -0600
                    Re: Nested PHP Stefan+Usenet@Froehlich.Priv.at (Stefan Froehlich) - 2014-02-12 12:14 +0000
        Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-02-10 22:09 +0000
        Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-02-10 23:23 +0100
        Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-10 22:27 +0000
        Re: Nested PHP Geoff Muldoon <geoff.muldoon@trap.gmail.com> - 2014-02-11 09:30 +1100
        Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-10 23:06 +0000
          Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-10 20:46 -0500
            Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 10:11 +0000
              Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-11 11:17 +0000
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 12:01 +0000
                  Re: Nested PHP Tim Streater <timstreater@greenbee.net> - 2014-02-11 12:45 +0000
                    Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-02-11 13:55 +0100
                      Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-11 13:29 +0000
                        Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 14:31 +0000
                          Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-11 17:24 +0000
              Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 08:15 -0500
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 14:31 +0000
                  Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 10:10 -0500
                    Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 15:31 +0000
                      Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 11:24 -0500
                        Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-12 10:13 +0000
                          Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-12 06:33 -0500
                  Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 15:26 +0000
              Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 14:41 +0000
                Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-02-11 15:31 +0000
                  Re: Nested PHP Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-02-11 15:53 +0000
                  Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-02-11 11:26 -0500
        Re: Nested PHP bill <william@TechServSys.com> - 2014-02-11 07:12 -0500
    Re: Nested PHP richard <noreply@example.com> - 2014-02-12 09:33 -0500
      Re: Nested PHP Denis McMahon <denismfmcmahon@gmail.com> - 2014-02-13 06:47 +0000
        Re: Nested PHP Scott Johnson <noonehome@chalupasworld.com> - 2014-02-13 05:01 -0800
          Re: Nested PHP Evan Platt <evan@theobvious.espphotography.com.invalid> - 2014-02-14 07:19 -0800
            Re: Nested PHP Scott Johnson <noonehome@chalupasworld.com> - 2014-02-14 10:43 -0800
    Re: Nested PHP Arno Welzel <usenet@arnowelzel.de> - 2014-03-02 15:54 +0100
      Re: Nested PHP adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) - 2014-03-02 18:10 +0000
      Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-03 11:38 +0000
        Re: Nested PHP Arno Welzel <usenet@arnowelzel.de> - 2014-03-17 15:26 +0100
          Re: Nested PHP Jerry Stuckle <jstucklex@attglobal.net> - 2014-03-17 10:52 -0400
          Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-17 15:33 +0000
            Re: Nested PHP "Peter H. Coffin" <hellsop@ninehells.com> - 2014-03-17 17:10 -0500
              Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-17 23:01 +0000
                Re: Nested PHP Christoph Michael Becker <cmbecker69@arcor.de> - 2014-03-18 00:31 +0100
                  Re: Nested PHP The Natural Philosopher <tnp@invalid.invalid> - 2014-03-18 13:10 +0000
    Re: Nested PHP Gabe <usenet@moojuice.net> - 2014-03-17 15:18 +0000

Page 3 of 3 — ← Prev page 1 2 [3]

#12795

adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) writes:

> Ben Bacarisse <ben.usenet@bsb.me.uk> wrote:
<snip>
>> The only time I saw anything like it, the author was unaware that
>> functions can be created by PHP functions (though how well this works
>> depends on the version of PHP that you have).  It may be that your task
>> can be achieved with any special re-execution mechanism.
>
> I think this is running on some version php 4. 

That's quite old now.

> I was not only unaware that functions could be created, but was
> convinced by the results of several searches that they could not.  I was
> probably searching for the wrong thing (until you know the answer, it is
> not obvious how to ask the right question), so could you please tell me
> what I should be looking for?

As it happens the main function is called create_function (PHP 4.0.1 and
newer).  A more convenient and flexible kind -- anonymous functions, or
closures -- was introduced in PHP 5.3.

However, I've now seen an outline of what you want to do and it does not
seem to need this sort of thing.

-- 
Ben.

[toc] | [prev] | [next] | [standalone]

#12797

On 2/11/2014 10:31 AM, Adrian Tuddenham wrote:
> Ben Bacarisse <ben.usenet@bsb.me.uk> wrote:
>
>> adrian@poppyrecords.invalid.invalid (Adrian Tuddenham) writes:
>>
>>> Jerry Stuckle <jstucklex@attglobal.net> wrote:
>> <snip>
>>>>   From what I can gather, he's generating a page which contains PHP code
>>>> from another PHP script, and sending the generated page to the browser -
>>>> expecting the generated PHP code to be executed (which, of course, it
>>>> isn't).
>>>
>>> That's right.
>>
>> I'll second (third?, forth?) the question: what are trying to do that
>> has lead to this design?  It seems all wrong.
>>
>> The only time I saw anything like it, the author was unaware that
>> functions can be created by PHP functions (though how well this works
>> depends on the version of PHP that you have).  It may be that your task
>> can be achieved with any special re-execution mechanism.
>
> I think this is running on some version php 4.
>

In that case I would *DEFINITELY* be looking for another hosting 
company.  PHP4 has been OOS for years now; not even security fixes are 
being issued for it.

> I was not only unaware that functions could be created, but was
> convinced by the results of several searches that they could not.  I was
> probably searching for the wrong thing (until you know the answer, it is
> not obvious how to ask the right question), so could you please tell me
> what I should be looking for?
>
>

Another hosting company.

PHP functions can be created on the fly - but they still won't be 
executed the way you are trying to do things.  They have to be executed 
in your script.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#12775

On 2/10/2014 4:44 PM, Adrian Tuddenham wrote:
> Jerry Stuckle <jstucklex@attglobal.net> wrote:
>
>> On 2/10/2014 3:24 PM, Adrian Tuddenham wrote:
>>> I am using a php program to generate and download a webpage as an HTML
>>> file, the HTML file draws its headers and navigation bar from another
>>> HTML file using some embedded php with an "include" command.
>>>
>>> The embedded php doesn't run when the file is downloaded, so the page
>>> appears in the browser without its headers or navigation.
>>>
>>> Is there a way of making the HTML file run the php or do I have to
>>> tackle this from another angle?
>>>
>>
>> The PHP code in your generated file is only executed when the file is
>> processed as a web page.  This is done by the web server, based on the
>> file extension (default is .php; you do have that as the file extension,
>> right?).
>
> Yes -  and the same code runs perfectly well with all its headers if the
> file is sitting on the server and I call it up with a browser.  It is
> only if I 'create' it on the fly from a php program that it doesn't work
> - the HTML runs but the php doesn't.
>
>> Any other means of downloading the file (i.e. ftp) will not cause the
>> PHP code to be executed.
>
> I was using a browser to view it, but the source code was coming from a
> php program, not directly from a file on the server.
>
>
perhaps you could include a code snippett that shows the 
sequence, or perhaps a pseudo code example.
bill

[toc] | [prev] | [next] | [standalone]

#12812

On Mon, 10 Feb 2014 20:24:55 +0000, Adrian Tuddenham wrote:

> I am using a php program to generate and download a webpage as an HTML
> file, the HTML file draws its headers and navigation bar from another
> HTML file using some embedded php with an "include" command.
> 
> The embedded php doesn't run when the file is downloaded, so the page
> appears in the browser without its headers or navigation.
> 
> Is there a way of making the HTML file run the php or do I have to
> tackle this from another angle?

If I understand this correctly, try naming the html file as php.
Any time you "include" another file you are using php.
Instead of include, try an iframe.
That way, the main page will be named html while the iframe page is php.
Style te iframe with no borders and nobody knows the difference.

[toc] | [prev] | [next] | [standalone]

#12815

On Wed, 12 Feb 2014 09:33:46 -0500, richard wrote:

> If I understand this correctly ...

Shut the fuck up, you have no idea what the OP wants to do or how to fix 
it!

Seriously, you have no place offering anyone advice on php, mysql, 
javascript, html or css, and need to learn to keep your idiot ideas to 
yourself.

It's reading crap like you post and erroneously believing it to be 
correct that gets you into the screwups you regularly suffer in the first 
place. You really shouldn't be perpetuating the same crap by 
regurgitating it at others.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#12819

On 2/12/14, 10:47 PM, Denis McMahon wrote:
> On Wed, 12 Feb 2014 09:33:46 -0500, richard wrote:
>
>> If I understand this correctly ...
>
> Shut the fuck up, you have no idea what the OP wants to do or how to fix
> it!
>
> Seriously, you have no place offering anyone advice on php, mysql,
> javascript, html or css, and need to learn to keep your idiot ideas to
> yourself.
>
> It's reading crap like you post and erroneously believing it to be
> correct that gets you into the screwups you regularly suffer in the first
> place. You really shouldn't be perpetuating the same crap by
> regurgitating it at others.
>


One word for you Dennis.

Decaf..;)

[toc] | [prev] | [next] | [standalone]

#12830

On Thu, 13 Feb 2014 05:01:44 -0800, Scott Johnson
<noonehome@chalupasworld.com> wrote:

>One word for you Dennis.
>
>Decaf..;)

No, it's richard bullis. The bitchslap is well deserved. 
He is always giving wrong and often even dangerous advice to people.
-- 
To reply via e-mail, remove The Obvious and .invalid from my e-mail address.

[toc] | [prev] | [next] | [standalone]

#12832

On 2/14/14, 7:19 AM, Evan Platt wrote:
> On Thu, 13 Feb 2014 05:01:44 -0800, Scott Johnson
> <noonehome@chalupasworld.com> wrote:
>
>> One word for you Dennis.
>>
>> Decaf..;)
>
> No, it's richard bullis. The bitchslap is well deserved.
> He is always giving wrong and often even dangerous advice to people.
>

I did not disagree with a single word he said, it was joking, hence the ;)

Scotty

[toc] | [prev] | [next] | [standalone]

#13042

Adrian Tuddenham, 2014-02-10 21:24:

> I am using a php program to generate and download a webpage as an HTML
> file, the HTML file draws its headers and navigation bar from another
> HTML file using some embedded php with an "include" command.
> 
> The embedded php doesn't run when the file is downloaded, so the page
> appears in the browser without its headers or navigation.

PHP is only executed on the *server*. Any PHP which is "dynamically"
added as output will *not* be executed at all.

Example - if you have a file "test.php" and request it using the browser
via http://mydomain.example/test.php:

<?php
echo "Test";
?>

This will just output "Test".

BUT: If the same will adds additional PHP code it will just be sent to
the browser without any interpetation by the PHP runtime:

<?php
echo "echo \"My embedded test\";";
?>

If you really need to execute "dynamic" PHP, you have to use eval(),
which executes the code passed as parameter:

<?php
$mycode = "echo \"My embedded test\";";

eval($mycode);
?>

Even though this may work - the problem with eval() is, that it is
horrible to debug. You don't have just a script but a script generating
another script which will then be executed.

I recommend to think about what you want to solve and if it is really
neccessary to create "dyanamic" PHP on the fly.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de
http://fahrradzukunft.de

[toc] | [prev] | [next] | [standalone]

#13043

Arno Welzel <usenet@arnowelzel.de> wrote:

> Adrian Tuddenham, 2014-02-10 21:24:
> 
> > I am using a php program to generate and download a webpage as an HTML
> > file, the HTML file draws its headers and navigation bar from another
> > HTML file using some embedded php with an "include" command.
> > 
> > The embedded php doesn't run when the file is downloaded, so the page
> > appears in the browser without its headers or navigation.
> 
> PHP is only executed on the *server*. Any PHP which is "dynamically"
> added as output will *not* be executed at all.
> 
> Example - if you have a file "test.php" and request it using the browser
> via http://mydomain.example/test.php:
> 
> <?php
> echo "Test";
> ?>
> 
> This will just output "Test".
> 
> BUT: If the same will adds additional PHP code it will just be sent to
> the browser without any interpetation by the PHP runtime:
> 
> <?php
> echo "echo \"My embedded test\";";
> ?>
> 
> If you really need to execute "dynamic" PHP, you have to use eval(),
> which executes the code passed as parameter:
> 
> <?php
> $mycode = "echo \"My embedded test\";";
> 
> eval($mycode);
> ?>
> 
> Even though this may work - the problem with eval() is, that it is
> horrible to debug. You don't have just a script but a script generating
> another script which will then be executed.
> 
> I recommend to think about what you want to solve and if it is really
> neccessary to create "dyanamic" PHP on the fly.

I've now solved the problem a different way which avoids this
difficulty.  

Thanks to all who helped.


-- 
~ Adrian Tuddenham ~
(Remove the ".invalid"s and add ".co.uk" to reply)
www.poppyrecords.co.uk

[toc] | [prev] | [next] | [standalone]

#13052

On 02/03/14 14:54, Arno Welzel wrote:
> Adrian Tuddenham, 2014-02-10 21:24:
>
>> I am using a php program to generate and download a webpage as an HTML
>> file, the HTML file draws its headers and navigation bar from another
>> HTML file using some embedded php with an "include" command.
>>
>> The embedded php doesn't run when the file is downloaded, so the page
>> appears in the browser without its headers or navigation.
>
> PHP is only executed on the *server*. Any PHP which is "dynamically"
> added as output will *not* be executed at all.
>
> Example - if you have a file "test.php" and request it using the browser
> via http://mydomain.example/test.php:
>
> <?php
> echo "Test";
> ?>
>
> This will just output "Test".
>
> BUT: If the same will adds additional PHP code it will just be sent to
> the browser without any interpetation by the PHP runtime:
>
> <?php
> echo "echo \"My embedded test\";";
> ?>
>
> If you really need to execute "dynamic" PHP, you have to use eval(),
> which executes the code passed as parameter:
>
> <?php
> $mycode = "echo \"My embedded test\";";
>
> eval($mycode);
> ?>
>
> Even though this may work - the problem with eval() is, that it is
> horrible to debug. You don't have just a script but a script generating
> another script which will then be executed.
>
it ain't that bad: the errors show up as error in eval script called on 
line X: error in evalled script on line Y

So you at least know what the errors is and where it is.

Gets more interesting if your evalled script also evals more script..


> I recommend to think about what you want to solve and if it is really
> neccessary to create "dyanamic" PHP on the fly.
>
Nice thing about evalled code is that you can stick it in a database..

>
>


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#13198

Am 03.03.2014 12:38, schrieb The Natural Philosopher:

> On 02/03/14 14:54, Arno Welzel wrote:
>> Adrian Tuddenham, 2014-02-10 21:24:
>>
[About eval()]
>> I recommend to think about what you want to solve and if it is really
>> neccessary to create "dyanamic" PHP on the fly.
>>
> Nice thing about evalled code is that you can stick it in a database..

You call it "nice" to put *code* in a database? I would call it an ugly
hack.

I know, some products like vBulletin do this in production environments
- they put all their plugins and some other stuff in the database.

But this does not mean this is "nice" nor even something you want. Even
WordPress does not try to put code into the database ;-)

This is only a hack for situations where a plugin installer in the
administrative backend may not be able to write the files.

Some may this even call more "secure" since you can set the folder
permissions more restrictive. Some may call this more "comfortable"
since you don't need to give the web server permissions to write to the
document root. But in the end - it doesn't matter if an attacker is able
to overwrite files or overwrite database content, and securing the
database is not as easy as protecting the filesystem.



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [next] | [standalone]

#13199

On 3/17/2014 10:26 AM, Arno Welzel wrote:
> Am 03.03.2014 12:38, schrieb The Natural Philosopher:
>
>> On 02/03/14 14:54, Arno Welzel wrote:
>>> Adrian Tuddenham, 2014-02-10 21:24:
>>>
> [About eval()]
>>> I recommend to think about what you want to solve and if it is really
>>> neccessary to create "dyanamic" PHP on the fly.
>>>
>> Nice thing about evalled code is that you can stick it in a database..
>
> You call it "nice" to put *code* in a database? I would call it an ugly
> hack.
>
> I know, some products like vBulletin do this in production environments
> - they put all their plugins and some other stuff in the database.
>
> But this does not mean this is "nice" nor even something you want. Even
> WordPress does not try to put code into the database ;-)
>
> This is only a hack for situations where a plugin installer in the
> administrative backend may not be able to write the files.
>
> Some may this even call more "secure" since you can set the folder
> permissions more restrictive. Some may call this more "comfortable"
> since you don't need to give the web server permissions to write to the
> document root. But in the end - it doesn't matter if an attacker is able
> to overwrite files or overwrite database content, and securing the
> database is not as easy as protecting the filesystem.
>
>
>

+1


-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#13202

On 17/03/14 14:26, Arno Welzel wrote:
> Am 03.03.2014 12:38, schrieb The Natural Philosopher:
>
>> On 02/03/14 14:54, Arno Welzel wrote:
>>> Adrian Tuddenham, 2014-02-10 21:24:
>>>
> [About eval()]
>>> I recommend to think about what you want to solve and if it is really
>>> neccessary to create "dyanamic" PHP on the fly.
>>>
>> Nice thing about evalled code is that you can stick it in a database..
>
> You call it "nice" to put *code* in a database? I would call it an ugly
> hack.
>

That is because what you are trying to achieve is not necessarily what I 
am trying to achieve.

What does a data base do well?
- breaks the directory hierarchy of data
- moves the data outside of the actual era directly accessible to te web 
server
- provides a one point of backup
- adds a security of access to the data and code not easily done in 
other ways.

In what I am working on, the advantages massively out weigh the 
disadvantages. Depending on the user login on this uber secure site, not 
only can they not see certain data, but the programs they can even 
execute are different, at three levels - I can configure them not to be 
accessible in any menus, and more to the point, even knowing their URL 
doesn't help, because to a user without permissions they are not just 
not executable, they don't actually exist - the server will return a 
'not found' if they try.

And at the third level I can set SQL permissions so that if a program 
bug renders than accessible, they cant be loaded with the SQL 
permissions the user has either. So that will throw a PHP/SQL errors and 
that helps me trace when I have the wrong code operating.

It gets better. Simply uploading malware into the web server hierarchy 
wont change the way the site behaves. Code has to be uploaded through a 
custom interface that isn't even on the same site as the web server, and 
all code changes can be recorded in the same database.

Code and data are separately modified through secure programs designed 
to allow just enough access to do the job. The code and data are not 
mixed up so that any person 'designing a website' can screw the whole 
operation up accidentally.





> I know, some products like vBulletin do this in production environments
> - they put all their plugins and some other stuff in the database.
>
> But this does not mean this is "nice" nor even something you want. Even
> WordPress does not try to put code into the database ;-)
>

What you want depends on what you are building.

Wordpress has to work in a situation where all you have is an 
administrative front end or a an ftp access TO THE SAME SITE in place.

That is already completely broken security wise.

I only administer the PUBLIC site and code via a secure encrypted 
connection to another site entirely.

Now that doesn't necessarily necessitate moving the code from a private 
hierarchy visible to PHP alone, but the ability to completely map any 
URL to any piece of code as well as to utterly disguise the fact that it 
is actually PHP in play, is very handy.

It also means that in the limit I can encrypt the code in the database.

All bar the decryption algo of course..and that means that even the 
sysadmins on the machine in its data centre cant have simple easy 
accidental access in a Snowden kind of way to reveal much about the site.

They can't say 'we were routinely exposed to the data' any attempt to 
decode it has to be a deliberate de facto criminal act.


In my case its a way to access intensely private and sensitive data in 
the most secure and hack proof  way possible whilst still having the 
ability to expose very selected parts of it to the pubic at large, and 
its also provides very de-skilled tools to manage that data at various 
different levels, and many tools to allow the monitoring of who is 
changing the code or data, when, and what IP address they are using.

Its a very secure very private cloud.


> This is only a hack for situations where a plugin installer in the
> administrative backend may not be able to write the files.
>
> Some may this even call more "secure" since you can set the folder
> permissions more restrictive. Some may call this more "comfortable"
> since you don't need to give the web server permissions to write to the
> document root. But in the end - it doesn't matter if an attacker is able
> to overwrite files or overwrite database content, and securing the
> database is not as easy as protecting the filesystem.
>
>
The important thing is that it should be very very hard for an attacker 
to gain any foothold without being detected.

Unless he manges to gain root access to the actual server, in my case 
the ONLY way is to use the 'staff entrance' which is very heavily 
monitored.

I am not saying he can't get root access, but every way that he might 
has at least one trap set.

At the moment the weak point is that the server is only a virtual 
private server, in someone elses machine room on someone else's 
hardware.,  and beyond the prototype I can envisage it being on a 
securely-located-in-customers-own-premises physical machine on the end 
of a high speed line.

That removes the major secuity hazard of outsourced hosting.


>


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#13203

On Mon, 17 Mar 2014 15:33:13 +0000, The Natural Philosopher wrote:
> What does a data base do well?
> - breaks the directory hierarchy of data
> - moves the data outside of the actual era directly accessible to te web 
> server
> - provides a one point of backup
> - adds a security of access to the data and code not easily done in 
> other ways.

Oh dear... Let's start with that SQL was developed to run on a machine
that had no directory hierarchy, had no web, didn't even really have
a concept of "file" that was distinct from "table", and backing stuff
up was a matter of "saving things", because you had no idea whether
something was in memory or disk and didn't care. The security wasn't
added on because the whole OS was pretty indistinguishable from the
database. Everything you've mentioned is a side-effect of the database,
not intrinsic to its use. You wanna run at this again? Nevermind,
I'll just tell you. A database allows you to separate data from
application in a way that allows you to change the data, including its
interdependant relationships and qualities, without necessarily changing
the application.

The data comes first. Anytime you're starting with the application
first, you're working not with a database, but rather with a "storage
subsystem". Which is all fine and dandy, but it slaps you with richard
problems forever, in varying severity, until you give up, start over
with the data, and do it right.

-- 
34. I will not turn into a snake. It never helps.
	--Peter Anspach's list of things to do as an Evil Overlord

[toc] | [prev] | [next] | [standalone]

#13204

On 17/03/14 22:10, Peter H. Coffin wrote:
> On Mon, 17 Mar 2014 15:33:13 +0000, The Natural Philosopher wrote:
>> What does a data base do well?
>> - breaks the directory hierarchy of data
>> - moves the data outside of the actual era directly accessible to te web
>> server
>> - provides a one point of backup
>> - adds a security of access to the data and code not easily done in
>> other ways.
>
> Oh dear... Let's start with that SQL was developed to run on a machine
> that had no directory hierarchy, had no web, didn't even really have
> a concept of "file" that was distinct from "table", and backing stuff
> up was a matter of "saving things", because you had no idea whether
> something was in memory or disk and didn't care. The security wasn't
> added on because the whole OS was pretty indistinguishable from the
> database. Everything you've mentioned is a side-effect of the database,
> not intrinsic to its use. You wanna run at this again? Nevermind,
> I'll just tell you. A database allows you to separate data from
> application in a way that allows you to change the data, including its
> interdependant relationships and qualities, without necessarily changing
> the application.
>
> The data comes first. Anytime you're starting with the application
> first, you're working not with a database, but rather with a "storage
> subsystem". Which is all fine and dandy, but it slaps you with richard
> problems forever, in varying severity, until you give up, start over
> with the data, and do it right.
>
ER no. Try actually taking of those spectacles or extreme prejudice and 
reading what I wrote.

Teh databse was already there for data.

It now contians applicatoin in different tables because the tools 
developed to manage secure and protecect the data can do exactly the 
same job on the code.

Consider the problem

I have page called /aby/xyz that I want accessible to one user and 
totalluy invisible to another.

At best htaccess makes it tricky and says 'not allowed' it wont ever say 
'page doesn't exist'.

My users already live in a proper relational database.What is easier 
than to write a slender shim that intercepts all access to the web 
server, analyses them  and decides who they are and what they can then 
access? Using tables of privilege, proriory and area to give a 
multidimensional; matrix of access. And the ability to return 'access 
denied' or 'page not found' under my control if they try and access 
something I don't want them to?

All of that is classic proper database use. IN the end I might of had a 
table of php files cross correlated to the uri's I wanted them to appear 
  under. I might, but at the point I said 'sod it, why not stick the 
code in the database as well, so its JUST a database call not a database 
call then then INCLUDE the file. And the file might get deleted leaving 
you with a database entry pointing to nothing. Stick it IN the database.

Code is after all data that has a special meaning, that's all.

I COLD have avoided eval by simply unloading the code onto disk, 
executing it as a php include, then deleting it.

How crap is that?

I COULD have kept an audit trail on the code by giving every programmer 
an actual linux login and letting them crawl around the host system, I 
chose to rather write a tool that lets them upload code, only, and 
tracks who uploaded when and where they uploaded it and why..a little 
more security and a lot more logging than Linux does by itself.


Yo have been taught RuUles. 'never use eval'

Rules are for the guidance of wise men, and the obedience of fools. What 
you think is that I am a richard, someone whose knowledge is minimal 
compared to your own.

It never enters your head I might in fact be thirty years ahead of you. 
And know EXACTLY what I am doing and have a very good reason based on 
sound experience and several weeks of considering the options, does it?



-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#13205

The Natural Philosopher wrote:

> Consider the problem
> 
> I have page called /aby/xyz that I want accessible to one user and
> totalluy invisible to another.
> 
> At best htaccess makes it tricky and says 'not allowed' it wont ever say
> 'page doesn't exist'.
> 
> My users already live in a proper relational database.What is easier
> than to write a slender shim that intercepts all access to the web
> server, analyses them  and decides who they are and what they can then
> access? Using tables of privilege, proriory and area to give a
> multidimensional; matrix of access. And the ability to return 'access
> denied' or 'page not found' under my control if they try and access
> something I don't want them to?

Why not deploying the page controller pattern?

  ...
  <?php
    analyzeHit();
    if (!userAuthorizedToViewThisPage()) {
      header('HTTP/1.0 403 Forbidden');
      exit;
    }
  ?>
  <!DOCTYPE html>
  ...

A front controller may be preferable (and it seems you're using
something like that), but that also doesn't require to store PHP code in
a database.

Actually, requiring authorization for delivering certain content is
quite common, but I doubt that there are (m)any sites storing PHP code
in a database for that reason.  The only reason I can see for storing
PHP code in a DB, is to cater for user submitted code, what may be
useful for e.g. CMSs.

-- 
Christoph M. Becker

[toc] | [prev] | [next] | [standalone]

#13206

On 17/03/14 23:31, Christoph Michael Becker wrote:
> The Natural Philosopher wrote:
>
>> Consider the problem
>>
>> I have page called /aby/xyz that I want accessible to one user and
>> totalluy invisible to another.
>>
>> At best htaccess makes it tricky and says 'not allowed' it wont ever say
>> 'page doesn't exist'.
>>
>> My users already live in a proper relational database.What is easier
>> than to write a slender shim that intercepts all access to the web
>> server, analyses them  and decides who they are and what they can then
>> access? Using tables of privilege, proriory and area to give a
>> multidimensional; matrix of access. And the ability to return 'access
>> denied' or 'page not found' under my control if they try and access
>> something I don't want them to?
>
> Why not deploying the page controller pattern?
>
>    ...
>    <?php
>      analyzeHit();
>      if (!userAuthorizedToViewThisPage()) {
>        header('HTTP/1.0 403 Forbidden');
>        exit;
>      }
>    ?>
>    <!DOCTYPE html>
>    ...
>
> A front controller may be preferable (and it seems you're using
> something like that), but that also doesn't require to store PHP code in
> a database.
>
> Actually, requiring authorization for delivering certain content is
> quite common, but I doubt that there are (m)any sites storing PHP code
> in a database for that reason.  The only reason I can see for storing
> PHP code in a DB, is to cater for user submitted code, what may be
> useful for e.g. CMSs.
>

in the end it was a balance of issues that decided it.

Probably the killer reason was  that having to use the database anyway 
to see whether or not the code would be executed, I was left with a list 
of code and 'stuff to do with this code' that would go in the database, 
and it seemed to be entirely within the basic database principle that 
you don't stick the thing and its attributes in two different places 
when there is always a 1:1 relationship... so the code followed the 
'attributes of this code' into the database.

That made eval the way to execute it.

Since the code is preformed anyway, there is no more danger in this than 
any other method. I.e. I am not using eval to allow some user response 
to execute arbitrary code. It is simply a 'subroutine call into a 
database'. And almost entirely equivalent to using include()




-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#13201

On 10/02/2014 20:24, Adrian Tuddenham wrote:
> I am using a php program to generate and download a webpage as an HTML
> file, the HTML file draws its headers and navigation bar from another
> HTML file using some embedded php with an "include" command.
>
> The embedded php doesn't run when the file is downloaded, so the page
> appears in the browser without its headers or navigation.
>
> Is there a way of making the HTML file run the php or do I have to
> tackle this from another angle?
>


Hi Adrian

If you have downloaded the HTML file in your PHP script and stored it as 
a variable named $html then you could make sure the PHP contained within 
it is executed by running it through the eval() function:

<?php

$html = '' # Downloaded string data
ob_clean();
eval('?>' . $html); # Execute HTML string data that contains PHP

# Capture the HTML file after the PHP in it has been executed.
$output = ob_get_clean();

# Force download of generated HTML to user browser
header('Content-type: text/html');

# Call the file generated.html
header('Content-Disposition: attachment; filename="generated.html"');

echo $output;

Some notes apply, using eval() is extremely dangerous. You should only 
use it if... actually you should never use it and find a different way 
instead. If you are at all unsure as to what you are doing and the 
security implications then you should avoid it. You should also avoid 
running any PHP that is downloaded from another site or source over 
which you do not have complete and total control. You really need to 
take in to account the warning on the PHP site:
http://www.php.net/manual/en/function.eval.php

Cheers

Gabe

[toc] | [prev] | [standalone]

Page 3 of 3 — ← Prev page 1 2 [3]

Back to top | Article view | comp.lang.php

csiph-web