2

I wrote some code which uses information from database to change content of various files and write something back to database afterwards.

This code is completly written in php and gets executed when I call a specific URL (htaccess protected).

Are there any security issues this could bring with it?

Probably relevant php-functions I use:

mysqli_connect($servername, $username, $password, $dbname);
file_get_contents($url);
file_put_contents($url);

Those are the functions I could imagine being "unsafe".

All the files are on a server!

Any tips on making it safer?

EDIT - trying to give important information: So I have a virtual server with various domains. On one of the domains there are folders with various files, which are created by a software. Those are different xml files and a html file. I need to add codesnippets to all html files.

For some other reasons I have the filepath stored in a database. My file (complete php) has a function which gets called when I open the url where my file lays and uses the above said functions to change the html files. There is nothing users can add or anything. My file just gets triggered --> executes --> changes files/db and gives me some information back on as html, whether the changes were successfull or not.

So my full "work procedure" is like this: create the html+xml with my software upload those on ftp put some information into database call the url to the php-file to edit my html-file(s) in the way I want.

As mentioned I have to enter htacces before I can trigger the php-file and only me and collegues know the path to the php-file.

  • 1
    There isn't enough information here to be able to provide useful information. The functions themselves are designed to do things which can potentially be dangerous, yes, but if they don't take user input, for example, you control what they do - if someone can modify the PHP files themselves, you've got bigger problems! If they do take user input, is it sanitised? Are the files executable? Or of a type which will be interpreted by something on the server? Or a configuration file for some other service? We just don't know... – Matthew Feb 3 '17 at 9:40
  • I´m pretty new to these security issues so it´s hard for me to tell what information you need. But I try to add some – Marcel Schmid Feb 3 '17 at 9:43
  • Your code is not even valid PHP, file_put_contents takes at least two arguments. – Rápli András Feb 3 '17 at 11:52
  • yeah true that, I just wrote this from mind, but ofc the actual code works – Marcel Schmid Feb 4 '17 at 12:33
1

Rely on path for security sounds weak to me (they can be cached by proxies), as relying on .htaccess (they can be ignored if admin fails the configuration when rebooting the server).

If the path & content written to HTML files are using the DB, and the PHP cannot alter it, then it sounds less attackable, but it could still be:

• If the wrote HTML file is the same as the read one (in-place file changes), then cascading calls may have unexpected results (ie: multiple string replacement/decoding)

• If one access the FTP, they can write anything to HTML files. That's normal. But here, when one access the DB, then they can write anything to HTML files too (and maybe to any file). So you made a new entrypoint, so new security challenges.

Why doing so online? There, you should do your trick on a local network, take the resulting files back, and push them to the real prod server. You won't have any risk of someone calling your build-script from the Internet. Otherwise, rely on non-homemade solutions. Take open-source ones, which will still have the same kind of flaws, but already analyzed & fixed by hundreds of people.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.