|
|
 |
장 19. Using remote files
여러분이 PHP를 설정할 때 "URL fopen wrapper"를 enable로 설정하였다면
(이 설정은 PHP 4.0.3 이하에서는 configure 스크립트에서
--disable-url-fopen-wrapper로 명시하지 하거나,
그 이후의 버전에서는 php.ini 파일에 allow_url_fopen을
off로 설정하지 않으면 설정된다.),
여러분은 파일이름을 파라메타로 가지는 대부분의 함수에 HTTP나 FTP URL을
파일이름으로 사용할 수 있다. 심지어 require()와
include() 함수에도 사용이 가능하다.
예를 들어, 이 기능을 사용하여 원격 웹 서버가 출력하는 내용을 파일로 열고,
그 출력 내용에서 원하는 데이타를 분석하여,
이 원하는 데이타로 데이타베이스 질의에 사용하거나,
웹 사이트에 맞는 모양으로 변형 시켜 출력할 수 있다
예 19-1. Getting the title of a remote page <?php
$file = fopen ("http://www.php.net/", "r");
if (!$file) {
echo "<p>Unable to open remote file.\n";
exit;
}
while (!feof ($file)) {
$line = fgets ($file, 1024);
/* This only works if the title and its tags are on one line */
if (eregi ("<title>(.*)</title>", $line, $out)) {
$title = $out[1];
break;
}
}
fclose($file);
?> |
|
여러분은 해당 서버에 권한이 있는 사용자로 접속하고,
해당 파일이 존재하지 않는다면, FTP를 이용한 파일에 쓸 수도 있다.
'anonymous'가 아닌 사용자로 접속하려면, URL내에 username을
(필요하다면 password도) 다음과 같이 명시해야 한다 :
'ftp://user:[email protected]/path/to/file'.
(또한 HTTP에서 Basic authentication을 사용한 인증을 요구하는 경우에도 이와 같은 문법을 사용할 수 있다.)
예 19-2. Storing data on a remote server <?php
$file = fopen ("ftp://ftp.php.net/incoming/outputfile", "w");
if (!$file) {
echo "<p>Unable to open remote file for writing.\n";
exit;
}
/* Write the data here. */
fputs ($file, "$HTTP_USER_AGENT\n");
fclose ($file);
?> |
|
참고:
여러분은 위의 예제를 보고, 이 테크닉을 사용하여 remote log를 작성할 수 있겠다고 생각할 수도 있다.
그러나 위에 언급한대로 URL fopen() wrapper는 새 파일에만 쓸 수 있다.
여러분이 원하는 대로 분산된 log를 하고 싶다면 syslog()의 내용을 살펴보라.
User Contributed Notes
Using remote files |
 add a note |
greg at b-sphere dot com
25-Apr-2000 09:21 |
|
To use images and links in an included or required web page on a remote
server, the calls in the remote files probably must use a fully qualified
URL (). Don't know
how universal this is, but it's been the case with several servers so far,
and no exceptions found. Since the URLs on the remote page are probably
using relative addressing, some added coordination is probably called for
in most collaboration projects, where one site is serving content to be
required or included on other sites.
|
|
php!at!sturmgewehr.de
25-Feb-2002 02:42 |
|
Be careful when you use something like index.php?showpage=news.php and
include() that $showpage file.
If a malicious user would call your
script as index.php?showpage= it
would include that script and run it in *your* script's scope. That means
it can read all files and variables your webserver has access to!
Use
file_exists() (which only works on local files) or check for 'tp:' in the
filename prior to inclusion.
|
|
jt at gno dot de
27-Feb-2002 12:24 |
|
Greg: I had your problem, too, and I simply solved it by defining a
<base href> tag in the script's HTML header. This points all
relative links and image sources of the included page to the defined
URL.
E.g. you run your script on yourhost.com and you include a site
from php.net then you would define <base href=">
Of
course you have to make your own references in the script global!
|
|
christer at frostmo dot com
04-Apr-2002 03:21 |
|
The easiest solution to this security risk is, in my oppinion, to add a
host string in front of the url specified in the url
adress.
example:
<html>
<head><title>php.net</title></head>
<body>
<?php
include(");
?>
</body>
</html>
yup
=) It's impossible to include() an page from another
server.
Regards,
Christer
Frostmo
Norway
www.frostmo.com
|
|
toby at butzon dot com
19-Apr-2002 12:15 |
|
It's important to understand that remote files included/required into your
script are NOT run on your server (as previous posts have suggested).
Think about it this way: When I do this:
<?php
include(');
?>
..I'm actually asking PHP to make a separate HTTP request
(just as your Web browser would) to www.example.com. So, point your
browser to that location. Do you see any PHP code? No. You will only see
HTML/text content.
(On the off chance that .php wasn't associated
with the PHP module/binary, the code would only be displayed. Thus, you
would have to TRY to make a dangerous include scenario -- such as
eval()'ing a remoted included file specified by the
user.)
Therefore, although this code may be vulnerable to an
"untrustworthy information" attack (where the information
displayed by your Web site isn't actually information you endorse, even
though the information is ultimately transferred from your Web server),
you are NOT vulnerable to malicious access to your Web server resources,
even if visitors can specify any remote server/file that they please.
|
|
klaus at netlibrary dot de
02-May-2002 04:08 |
|
In my experience, I cannot agree with Toby. Scripts can indeed be run
through remotely included files. All that needs to be done is put the PHP
script into an HTML or other file that is not parsed by the remote
server.
This theoretically enables a malicious scripter to attack
using a series of steps. For example, a simple .htm file with the
content
<?php
echo phpinfo();
?>
will give quite
a bit of information about the local system and possibly will give enough
information to wreak havoc in the server's file system. If you would like
to try this out, create an 'includetest.php' in a protected directory on
your server with the content
<?php
include
$inc;
?>
Pass the file to be included as
'includetest.php?inc=
The
page is on one of my less used servers and can be accessed with any
browser to show that it is simply the phpinfo() command I described
above.
I have tested this on 3 servers, all running PHP < 4.2.0,
and unless this was fixed in the latest release, it still works.
|
|
php at jerde dot net
06-May-2002 09:22 |
|
You must be VERY careful if you allow a variable to control the URL of an
include()ed file.
A previous poster suggested:
include(");
This,
however, won't work in all cases. For example, set the variable to
"@www.evil-site.dom/evil-code.phps"
Your carefully
constructed pre-URL is now sent merely as a username to the attacker's web
site.
Stripping out "@" and ":" would be a good
idea, and THEN you'd probably be safe.
- Peter
Jerde
Minneapolis, Minnesota, USA
|
|
joachim_php dot net at schirrmachers dot de
05-Jul-2002 03:19 |
|
It seems that it isn't possible to replace the standard browser signature
sent in an fopen(') call with another
value, i.e. the current value of $HTTP_USER_AGENT
|
|
elfyn at exposure dot org dot uk
18-Aug-2002 04:48 |
|
What toby said is pretty on the line. Same with klaus. But if your going to
do something that silly like allowing a third-party to include files into
your php script you should atleast 1) re the file contents to see if it
contains php tags or 2) use a function in 'String functions' strip_tags to
remove any php, although if you use this with the default settings it
would remove html.
|
|
vlad at vkelman dot com
09-Nov-2002 08:37 |
|
There is a good news for klaus at netlibrary dot de and others: PHP 4.2.3.
DOES block include('some_html_file'). It doesn't matter if this file has
actual PHP inside or not: include() doesn't work. You can use fopen() or
readfile(), but this means, the content won't be executed and therefore no
more vulnerability exists.
|
|
ohlesbeauxjours at yahoo dot fr
03-Dec-2002 03:43 |
|
In reply to Vlad who mentionned a problem with PHP version 4.2.3
:
require "
...
worked fine for me.
But note that I had to ask my web host supplier to
configure its proxy server so that the IP for
"www.somewhere.org" can be accepted for http
requests.
Otherwise, if you don't desactivate that security mechanism
on the web server, you won't see any warning or error messages when you
execute your script, but only a "blocked" page, stopped at the
instruction "require(")"
|
|
buht at mail dot ru
10-Dec-2002 10:16 |
|
I`ve read all that You say and try to do next two simple files.
First
file make include throught Web:
<?php
include(');
?>
Second
File (test.php) make output as html, but result is the new php
script:
<?
echo "<?\$ip=getenv('REMOTE_HOST');echo
\"IP=\$ip;\";?>";
?>
That work perfectly
without searching of server that does not support of php scripts but allow
to store php files on it. Extention is also not important.
So that is
more secure to reject using of including through Web.
But know somebody
any other possibility to include a document as it from another URL using
php?
|
|
robro at compsoc dot nuigalway dot ie dot nospam
14-Jan-2003 01:37 |
|
The easiest way I'd see around the security hold mentioned above would be
to turn off allow_url_fopen, using ini_set.
If that is not
acceptable you can simply str_replace out the :// part that seperates the
protocol from the address.
include( str_replace("://",
"", $whatever) );
should do the trick.
|
|
|
add a note |
| |
PHP Manual
Features
HTTP authentication with PHP
Using remote files
PUT method support