|
|
 |
Hoofdstuk 19. Het gebruik van remote bestanden
Zo lang de ondersteuning voor "URL fopen wrapper" actief is
wanneer je PHP configureert (is standaard actief tenzij je expliciet de
--disable-url-fopen-wrapper optie gebruikt (voor versies
tot en met 4.0.3) of allow_url_fopen zet to
"off" (voor nieuwere versies) kun je HTTP en FTP urls gebruiken
met de meeste functies die standaard gezien een bestandsnaam als argument
vereisen, dit werkt ook met de require() en
include() functies.
Opmerking:
Op het Windows platform kun je geen remote bestanden gebruiken als
argument in de include() en
require() functies.
Je kunt dit bijvoorbeeld gebruiken om een bestand te openen op een
andere webserver, de output verwerken om de data te krijgen die jij wilt
hebben en vervolgens deze data in een database query gebruiken of om
simpel weg deze data weer te geven in je eigen website-stijl.
Voorbeeld 19-1. De titel van een remote pagina op halen. <?php
$bestand = fopen ("http://www.php.net/", "r");
if (!$bestand) {
echo "<p>Kon remote bestand niet open.\n";
exit;
}
while (!feof ($bestand)) {
$regel = fgets ($bestand, 1024);
/* dit werkt alleen als de titel en <title> en </title> op 1 regel staan */
if (eregi ("<title>(.*)</title>", $regel, $matches)) {
$titel = $matches[1];
break;
}
}
fclose($bestand);
?> |
|
Je kunt ook naar bestanden schrijven op een FTP server als je teminste
de juiste rechten hebt voor deze operatie en zolang het bestand nog
niet bestaat op de FTP server. Om in te loggen als een user anders dan
'anonymous' moet je je gebruikersnaam en mogelijk je paswoord opgeven in de URL,
dit gaat op deze manier:
'ftp://gebruikersnaam:[email protected]/pad/naar/bestand'
Op deze manier kan je ook over HTTP toegang krijgen tot bestanden die
'Basic Authentication' vereisen.
Voorbeeld 19-2. Data opslaan op een andere server <?php
$bestand = fopen ("ftp://ftp.php.net/incoming/outputfile", "w");
if (!$bestand) {
echo "<p>Kon remote bestand niet openen om naar te schrijven\n</p>";
exit;
}
/* Schrijf data weg */
fputs ($bestand, "$HTTP_USER_AGENT\n");
fclose ($bestand);
?> |
|
Opmerking:
Je kunt het idee krijgen om deze techniek te gebruiken om te schrijven
naar een log op een andere server, maar zoals eerder gezegd kan je alleen
schrijven naar bestanden die nog niet bestaan. Om 'distributed logging'
mogelijk te maken zou je moeten kijken naar syslog().
User Contributed Notes
Het gebruik van remote bestanden |
 add a note |
greg at b-sphere dot com
25-Apr-2000 09:21 |
|
To use images and links in an included or required web page on a remote
server, the calls in the remote files probably must use a fully qualified
URL (). Don't know
how universal this is, but it's been the case with several servers so far,
and no exceptions found. Since the URLs on the remote page are probably
using relative addressing, some added coordination is probably called for
in most collaboration projects, where one site is serving content to be
required or included on other sites.
|
|
php!at!sturmgewehr.de
25-Feb-2002 02:42 |
|
Be careful when you use something like index.php?showpage=news.php and
include() that $showpage file.
If a malicious user would call your
script as index.php?showpage= it
would include that script and run it in *your* script's scope. That means
it can read all files and variables your webserver has access to!
Use
file_exists() (which only works on local files) or check for 'tp:' in the
filename prior to inclusion.
|
|
jt at gno dot de
27-Feb-2002 12:24 |
|
Greg: I had your problem, too, and I simply solved it by defining a
<base href> tag in the script's HTML header. This points all
relative links and image sources of the included page to the defined
URL.
E.g. you run your script on yourhost.com and you include a site
from php.net then you would define <base href=">
Of
course you have to make your own references in the script global!
|
|
christer at frostmo dot com
04-Apr-2002 03:21 |
|
The easiest solution to this security risk is, in my oppinion, to add a
host string in front of the url specified in the url
adress.
example:
<html>
<head><title>php.net</title></head>
<body>
<?php
include(");
?>
</body>
</html>
yup
=) It's impossible to include() an page from another
server.
Regards,
Christer
Frostmo
Norway
www.frostmo.com
|
|
toby at butzon dot com
19-Apr-2002 12:15 |
|
It's important to understand that remote files included/required into your
script are NOT run on your server (as previous posts have suggested).
Think about it this way: When I do this:
<?php
include(');
?>
..I'm actually asking PHP to make a separate HTTP request
(just as your Web browser would) to www.example.com. So, point your
browser to that location. Do you see any PHP code? No. You will only see
HTML/text content.
(On the off chance that .php wasn't associated
with the PHP module/binary, the code would only be displayed. Thus, you
would have to TRY to make a dangerous include scenario -- such as
eval()'ing a remoted included file specified by the
user.)
Therefore, although this code may be vulnerable to an
"untrustworthy information" attack (where the information
displayed by your Web site isn't actually information you endorse, even
though the information is ultimately transferred from your Web server),
you are NOT vulnerable to malicious access to your Web server resources,
even if visitors can specify any remote server/file that they please.
|
|
klaus at netlibrary dot de
02-May-2002 04:08 |
|
In my experience, I cannot agree with Toby. Scripts can indeed be run
through remotely included files. All that needs to be done is put the PHP
script into an HTML or other file that is not parsed by the remote
server.
This theoretically enables a malicious scripter to attack
using a series of steps. For example, a simple .htm file with the
content
<?php
echo phpinfo();
?>
will give quite
a bit of information about the local system and possibly will give enough
information to wreak havoc in the server's file system. If you would like
to try this out, create an 'includetest.php' in a protected directory on
your server with the content
<?php
include
$inc;
?>
Pass the file to be included as
'includetest.php?inc=
The
page is on one of my less used servers and can be accessed with any
browser to show that it is simply the phpinfo() command I described
above.
I have tested this on 3 servers, all running PHP < 4.2.0,
and unless this was fixed in the latest release, it still works.
|
|
php at jerde dot net
06-May-2002 09:22 |
|
You must be VERY careful if you allow a variable to control the URL of an
include()ed file.
A previous poster suggested:
include(");
This,
however, won't work in all cases. For example, set the variable to
"@www.evil-site.dom/evil-code.phps"
Your carefully
constructed pre-URL is now sent merely as a username to the attacker's web
site.
Stripping out "@" and ":" would be a good
idea, and THEN you'd probably be safe.
- Peter
Jerde
Minneapolis, Minnesota, USA
|
|
joachim_php dot net at schirrmachers dot de
05-Jul-2002 03:19 |
|
It seems that it isn't possible to replace the standard browser signature
sent in an fopen(') call with another
value, i.e. the current value of $HTTP_USER_AGENT
|
|
elfyn at exposure dot org dot uk
18-Aug-2002 04:48 |
|
What toby said is pretty on the line. Same with klaus. But if your going to
do something that silly like allowing a third-party to include files into
your php script you should atleast 1) re the file contents to see if it
contains php tags or 2) use a function in 'String functions' strip_tags to
remove any php, although if you use this with the default settings it
would remove html.
|
|
vlad at vkelman dot com
09-Nov-2002 08:37 |
|
There is a good news for klaus at netlibrary dot de and others: PHP 4.2.3.
DOES block include('some_html_file'). It doesn't matter if this file has
actual PHP inside or not: include() doesn't work. You can use fopen() or
readfile(), but this means, the content won't be executed and therefore no
more vulnerability exists.
|
|
ohlesbeauxjours at yahoo dot fr
03-Dec-2002 03:43 |
|
In reply to Vlad who mentionned a problem with PHP version 4.2.3
:
require "
...
worked fine for me.
But note that I had to ask my web host supplier to
configure its proxy server so that the IP for
"www.somewhere.org" can be accepted for http
requests.
Otherwise, if you don't desactivate that security mechanism
on the web server, you won't see any warning or error messages when you
execute your script, but only a "blocked" page, stopped at the
instruction "require(")"
|
|
buht at mail dot ru
10-Dec-2002 10:16 |
|
I`ve read all that You say and try to do next two simple files.
First
file make include throught Web:
<?php
include(');
?>
Second
File (test.php) make output as html, but result is the new php
script:
<?
echo "<?\$ip=getenv('REMOTE_HOST');echo
\"IP=\$ip;\";?>";
?>
That work perfectly
without searching of server that does not support of php scripts but allow
to store php files on it. Extention is also not important.
So that is
more secure to reject using of including through Web.
But know somebody
any other possibility to include a document as it from another URL using
php?
|
|
robro at compsoc dot nuigalway dot ie dot nospam
14-Jan-2003 01:37 |
|
The easiest way I'd see around the security hold mentioned above would be
to turn off allow_url_fopen, using ini_set.
If that is not
acceptable you can simply str_replace out the :// part that seperates the
protocol from the address.
include( str_replace("://",
"", $whatever) );
should do the trick.
|
|
|
add a note |
| |
PHP Handleiding
Functionaliteit
HTTP authenticatie met PHP
Het gebruik van remote bestanden
PUT methode ondersteuning