|
|
 |
Aussi longtemps que le support de la fonction d'ouverture
g�n�rique de fichiers ("URL fopen wrapper")
est actif lorsque vous configurez PHP (il est inutile de
passer explicitement l'option
--disable-url-fopen-wrapper
pour faire la configuration), vous pouvez utiliser des URLs
(HTTP et FTP) avec la majorit� des fonctions qui utilisent un
nom de fichier comme param�tre, ceci incluant les expressions
require() et include().
Note�:
Vous ne pouvez pas utiliser les fichiers distants dans les expressions
include() et require() sous Windows.
Par exemple, vous pouvez suivre l'exemple suivant pour ouvrir un
fichier sur un serveur web distant, analyser les r�sultats
pour extraire les informations dont vous avez besoin, et ensuite
l'utiliser dans une requ�te de base de donn�es, ou
simplement �diter les informations dans le style de votre site.
Exemple 20-1. Conna�tre le titre d'une page distante <?php
$file = fopen("http://www.php.net/", "r");
if (!$file) {
echo "<p>Impossible d'ouvrir le fichier distant.\n";
exit;
}
while (!feof($file)) {
$line = fgets($file, 1024);
/* Cela ne fonctionne que si le titre est �crit sur une ligne.*/
if (eregi("<title>(.*)</title>", $line, $out)) {
$title = $out[1];
break;
}
}
fclose($file);
?> |
|
Vous pouvez aussi �crire des fichiers sur un serveur FTP
aussi longtemps que vous �tes connect� avec un
utilisateur ayant les bons droits d'acc�s, alors que le
fichier n'existait pas encore. Pour vous connecter avec un
utilisateur autre qu'anonyme, vous devez sp�cifier un
nom d'utilisateur (et certainement le mot de passe) dans l'URL,
comme par exemple 'ftp://user:[email protected]/path/to/file'.
(Vous pouvez utiliser le m�me type de syntaxe pour acc�der
aux fichiers via HTTP lorsqu'ils n�cessitent une
authentification basique).
Exemple 20-2. Stocker des donn�es sur un serveur distant <?php
$file = fopen("ftp://ftp.php.net/incoming/outputfile", "w");
if (!$file) {
echo "<p>Impossible d'ouvrir un fichier distant en �criture.\n";
exit;
}
/* Ecriture des donn�es. */
fputs($file, "$HTTP_USER_AGENT\n");
fclose($file);
?> |
|
Note�:
Remarque: Vous pouvez avoir l'id�e,� partir de
l'exemple ci-dessus, d'utiliser la m�me technique pour
�crire sur un log distant, mais comme mentionn� ci-dessus
vous ne pouvez qu'�crire sur un nouveau fichier en utilisant
les fonctions fopen() avec une URL. Pour faire des log
distribu�s, nous vous conseillons de regarder la partie
syslog().
User Contributed Notes
Utilisation des fichiers � distance |
  |
[email protected]
25-Apr-2000 08:21 |
|
To use images and links in an included or required web page on a remote
server, the calls in the remote files probably must use a fully qualified
URL (). Don't know
how universal this is, but it's been the case with several servers so far,
and no exceptions found. Since the URLs on the remote page are probably
using relative addressing, some added coordination is probably called for
in most collaboration projects, where one site is serving content to be
required or included on other sites.
|
|
php!at!sturmgewehr.de
25-Feb-2002 01:42 |
|
Be careful when you use something like index.php?showpage=news.php and
include() that $showpage file.
If a malicious user would call your
script as index.php?showpage= it
would include that script and run it in *your* script's scope. That means
it can read all files and variables your webserver has access to!
Use
file_exists() (which only works on local files) or check for 'tp:' in the
filename prior to inclusion.
|
|
[email protected]
26-Feb-2002 11:24 |
|
Greg: I had your problem, too, and I simply solved it by defining a
<base href> tag in the script's HTML header. This points all
relative links and image sources of the included page to the defined
URL.
E.g. you run your script on yourhost.com and you include a site
from php.net then you would define <base href=">
Of
course you have to make your own references in the script global!
|
|
[email protected]
04-Apr-2002 02:21 |
|
The easiest solution to this security risk is, in my oppinion, to add a
host string in front of the url specified in the url
adress.
example:
<html>
<head><title>php.net</title></head>
<body>
<?php
include(");
?>
</body>
</html>
yup
=) It's impossible to include() an page from another
server.
Regards,
Christer
Frostmo
Norway
www.frostmo.com
|
|
[email protected]
18-Apr-2002 11:15 |
|
It's important to understand that remote files included/required into your
script are NOT run on your server (as previous posts have suggested).
Think about it this way: When I do this:
<?php
include(');
?>
..I'm actually asking PHP to make a separate HTTP request
(just as your Web browser would) to www.example.com. So, point your
browser to that location. Do you see any PHP code? No. You will only see
HTML/text content.
(On the off chance that .php wasn't associated
with the PHP module/binary, the code would only be displayed. Thus, you
would have to TRY to make a dangerous include scenario -- such as
eval()'ing a remoted included file specified by the
user.)
Therefore, although this code may be vulnerable to an
"untrustworthy information" attack (where the information
displayed by your Web site isn't actually information you endorse, even
though the information is ultimately transferred from your Web server),
you are NOT vulnerable to malicious access to your Web server resources,
even if visitors can specify any remote server/file that they please.
|
|
[email protected]
02-May-2002 03:08 |
|
In my experience, I cannot agree with Toby. Scripts can indeed be run
through remotely included files. All that needs to be done is put the PHP
script into an HTML or other file that is not parsed by the remote
server.
This theoretically enables a malicious scripter to attack
using a series of steps. For example, a simple .htm file with the
content
<?php
echo phpinfo();
?>
will give quite
a bit of information about the local system and possibly will give enough
information to wreak havoc in the server's file system. If you would like
to try this out, create an 'includetest.php' in a protected directory on
your server with the content
<?php
include
$inc;
?>
Pass the file to be included as
'includetest.php?inc=
The
page is on one of my less used servers and can be accessed with any
browser to show that it is simply the phpinfo() command I described
above.
I have tested this on 3 servers, all running PHP < 4.2.0,
and unless this was fixed in the latest release, it still works.
|
|
[email protected]
06-May-2002 08:22 |
|
You must be VERY careful if you allow a variable to control the URL of an
include()ed file.
A previous poster suggested:
include(");
This,
however, won't work in all cases. For example, set the variable to
"@www.evil-site.dom/evil-code.phps"
Your carefully
constructed pre-URL is now sent merely as a username to the attacker's web
site.
Stripping out "@" and ":" would be a good
idea, and THEN you'd probably be safe.
- Peter
Jerde
Minneapolis, Minnesota, USA
|
|
[email protected]
05-Jul-2002 02:19 |
|
It seems that it isn't possible to replace the standard browser signature
sent in an fopen(') call with another
value, i.e. the current value of $HTTP_USER_AGENT
|
|
[email protected]
26-Jul-2002 05:12 |
|
From experiments seem that user (and password) is what is before
<B>first</B> @. So
include("
.$HTTP_GET_VARS["url"]);
will be safe.
It is right in every version ?
|
|
[email protected]
18-Aug-2002 03:48 |
|
What toby said is pretty on the line. Same with klaus. But if your going to
do something that silly like allowing a third-party to include files into
your php script you should atleast 1) re the file contents to see if it
contains php tags or 2) use a function in 'String functions' strip_tags to
remove any php, although if you use this with the default settings it
would remove html.
|
|
|
|
| |
Chargement par m�thode PUT 