5

I have a webpage that basically uses the following structure:

index.php
functions.php
pages/a.php
pages/b.php
...

When I call index.php, the user is prompted to login or is logged in automatically by a session-id. index.php calls pages/a.php etc. when clicks in the navigation are done. index.php includes functions.php, which does all the right-checking-stuff in has_rights(...).

Every pages-file is kind of like this:

if(has_rights(...)) {
    ...
}

Whenever I open $url/pages/a.php on it's own, I get a blank page and an error-message in the log that has_rights is not defined. To the outside, this message is not visible, and there's no obvious way to get the filenames in pages. Also, pages should not be called on their own because of missing header-stuff (CSS, Javascript, ...). Is it a danger and if so, how could that be exploited?

Should every pages-file include functions.php for rights-checking, and check seperately whether it's called on it's own, or is it enough to simply fail compiling and send an empty page to the browser?

1
  • 5
    If page is not meant to be accessible via URL, it's best to keep it outside web server root directory. Commented Jul 7, 2017 at 20:44

1 Answer 1

1

It is enough to rely on the compilation error but it makes your webpage more error prone. For example maybe sometime you will (accidentally) enable php error output and then you will have a information disclosure. You should always make it hard to do mistakes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .