php-general Digest 28 Oct 2005 06:41:49 -0000 Issue 3762
Topics (messages 224731 through 224754):
Re: Using PHP for accsess control, preventing access to static files
224731 by: Dan Trainor
224732 by: Ben
224740 by: Dan Trainor
224741 by: Ben
224744 by: Dan Trainor
224749 by: Jeffrey Sambells
How to account for misspellings and alternatives in searching?
224733 by: Chris W. Parker
224736 by: James Benson
Trouble using DOM component with PHP 4.4.0
224734 by: Andrew Kachalo
224735 by: Andrew Kachalo
224739 by: Alessandro Rossini
224742 by: Andrew Kachalo
224743 by: James Benson
Re: Strange array access problem
224737 by: Al
Re: regex and global vars problem
224738 by: Al
224750 by: Tom Rogers
foreach / unset
224745 by: Richard Lynch
224748 by: Niels Ganser
Decompressing a string with zlib problems
224746 by: Graham Anderson
PHP5 class constants
224747 by: Dragan Stanojevic - Nevidljivi
224751 by: Jasper Bryant-Greene
224752 by: Dragan Stanojevic - Nevidljivi
224753 by: Chris
PHP version check
224754 by: Andrew Kachalo
Administrivia:
To subscribe to the digest, e-mail:
[EMAIL PROTECTED]
To unsubscribe from the digest, e-mail:
[EMAIL PROTECTED]
To post to the list, e-mail:
[email protected]
----------------------------------------------------------------------
--- Begin Message ---
Jason Motes wrote:
>>
>> I'm designing a controlled access system in PHP, and it's coming along
>> quite well. It's very simple, and just sets a session varibale, such as
>> $_SESSION['authenticated'] = 1, not a whole lot.
>>
>> Now I run a small sniplet of code on the top of each HTML and PHP file,
>> which checks for this variable, and either allows or denys access to the
>> page.
>>
>> However, how do people protect against the downloading of real files,
>> ones which are not parsed by PHP? .WMV, .MOV, .ZIP, .EXE and so on? I
>> want to protect access to these as well, and if a visitor just types in
>> a URL and is able to access the file because my access control mechanism
>> simply doesn't work on those types of files, what should be the solution
>> here?
>>
>> It's been suggested to use readfile() to accomplish this, by forwarding
>> content from outside of the document root - but this just sounds odd.
>> On top of being (what I think would be) incredibly slow, it just doesn't
>> sound "right".
>>
>
> I had a similar issue. I ended up using a .htaccess so that you could
> not open the file directly. If checked for the referrer. This is not
> the most secure way to do it. I know it can be spoofed.
>
> IndexIgnore *
> SetEnvIfNoCase Referer "^http://example.com/viewer.php" local_ref=1
> Order Allow,Deny
> Allow from env=local_ref
>
> Jason Motes
> php at imotes.com
>
Thanks for the reply, Jason -
I'd like to keep the application as portable as possible; thus, I cannot
use any kind of htaccess hackery because I want this PHP application to
run on IIS, as well.
Thanks
-dant
--- End Message ---
--- Begin Message ---
Dan Trainor said the following on 10/27/2005 10:39 AM:
Jason Motes wrote:
However, how do people protect against the downloading of real files,
ones which are not parsed by PHP? .WMV, .MOV, .ZIP, .EXE and so on? I
want to protect access to these as well, and if a visitor just types in
a URL and is able to access the file because my access control mechanism
simply doesn't work on those types of files, what should be the solution
here?
<snip>
I'd like to keep the application as portable as possible; thus, I cannot
use any kind of htaccess hackery because I want this PHP application to
run on IIS, as well.
Move the files outside the document root so that they aren't available
via a direct URL, then create a 'file access page' in php that will
check for the session variable and either send or not send the file
based on whether the user has access.
- Ben
--- End Message ---
--- Begin Message ---
Ben wrote:
> Dan Trainor said the following on 10/27/2005 10:39 AM:
>
>> Jason Motes wrote:
>
>
>>>> However, how do people protect against the downloading of real files,
>>>> ones which are not parsed by PHP? .WMV, .MOV, .ZIP, .EXE and so on? I
>>>> want to protect access to these as well, and if a visitor just types in
>>>> a URL and is able to access the file because my access control
>>>> mechanism
>>>> simply doesn't work on those types of files, what should be the
>>>> solution
>>>> here?
>
>
> <snip>
>
>> I'd like to keep the application as portable as possible; thus, I cannot
>> use any kind of htaccess hackery because I want this PHP application to
>> run on IIS, as well.
>
>
> Move the files outside the document root so that they aren't available
> via a direct URL, then create a 'file access page' in php that will
> check for the session variable and either send or not send the file
> based on whether the user has access.
>
> - Ben
>
Ben -
I knew this, but it was the "send or not send" thing that I was
concerned about ;)
Thanks
-dant
--- End Message ---
--- Begin Message ---
Dan Trainor said the following on 10/27/2005 01:34 PM:
Ben wrote:
Move the files outside the document root so that they aren't available
via a direct URL, then create a 'file access page' in php that will
check for the session variable and either send or not send the file
based on whether the user has access.
- Ben
Ben -
I knew this, but it was the "send or not send" thing that I was
concerned about ;)
Sounds like you need to have a look here:
http://ca3.php.net/manual/en/ref.filesystem.php
and specifically here:
http://ca3.php.net/manual/en/function.fpassthru.php
and so you can set the proper headers:
http://ca3.php.net/manual/en/function.filetype.php
The on-line manual is your friend :-).
Also, you will want to be _very_ careful about ensuring that the file
you are sending is in fact the file you want to be sending (ie
/etc/passwd would be a no-no).
- Ben
--- End Message ---
--- Begin Message ---
Ben wrote:
> Dan Trainor said the following on 10/27/2005 01:34 PM:
>
>> Ben wrote:
>>
>>> Move the files outside the document root so that they aren't available
>>> via a direct URL, then create a 'file access page' in php that will
>>> check for the session variable and either send or not send the file
>>> based on whether the user has access.
>>>
>>> - Ben
>>>
>>
>>
>> Ben -
>>
>> I knew this, but it was the "send or not send" thing that I was
>> concerned about ;)
>
>
> Sounds like you need to have a look here:
> http://ca3.php.net/manual/en/ref.filesystem.php
>
> and specifically here:
> http://ca3.php.net/manual/en/function.fpassthru.php
>
> and so you can set the proper headers:
> http://ca3.php.net/manual/en/function.filetype.php
>
> The on-line manual is your friend :-).
>
> Also, you will want to be _very_ careful about ensuring that the file
> you are sending is in fact the file you want to be sending (ie
> /etc/passwd would be a no-no).
>
> - Ben
>
Ben -
Yes, I've been playing with passthru() today, and it's quite
interesting. I think it's going to work. I made a little pass-through
(pardon the pun) scriupt to do exactly what I'm looking for.
I've already started working on a set of sanity checks and such for the
requested files to prevent such malicious activity.
I want to thank you all again for your help.
Thanks!
-dant
--- End Message ---
--- Begin Message ---
I ran into a similar problem and came up with a slightly different
solution...
As an alternative to passing the file directly through PHP, if you
are running apache, you could DENY access to all files in a directory
and then use PHP to dynamically update a local .htaccess file with
valid sessions and use something like mod_security or a simple cookie/
query_string check to see if the requested file has a valid session.
Then apache would handle the download as normal so users could use
whatever download mechanism they want.
- jeff
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Jeffrey Sambells
Director of Research and Development
Zend Certified Engineer (ZCE)
We-Create Inc.
[EMAIL PROTECTED] email
519.745.7374 office
519.897.2552 mobile
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Get Mozilla Firefox at
http://spreadfirefox.com
On 27-Oct-05, at 5:45 PM, Dan Trainor wrote:
Ben wrote:
Dan Trainor said the following on 10/27/2005 01:34 PM:
Ben wrote:
Move the files outside the document root so that they aren't
available
via a direct URL, then create a 'file access page' in php that will
check for the session variable and either send or not send the file
based on whether the user has access.
- Ben
Ben -
I knew this, but it was the "send or not send" thing that I was
concerned about ;)
Sounds like you need to have a look here:
http://ca3.php.net/manual/en/ref.filesystem.php
and specifically here:
http://ca3.php.net/manual/en/function.fpassthru.php
and so you can set the proper headers:
http://ca3.php.net/manual/en/function.filetype.php
The on-line manual is your friend :-).
Also, you will want to be _very_ careful about ensuring that the file
you are sending is in fact the file you want to be sending (ie
/etc/passwd would be a no-no).
- Ben
Ben -
Yes, I've been playing with passthru() today, and it's quite
interesting. I think it's going to work. I made a little pass-
through
(pardon the pun) scriupt to do exactly what I'm looking for.
I've already started working on a set of sanity checks and such for
the
requested files to prevent such malicious activity.
I want to thank you all again for your help.
Thanks!
-dant
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--- End Message ---
--- Begin Message ---
Hello,
On my site right now if someone searches for "511" (a misspelling of the
manufacturer 5.11) they are not presented with the right products
because 511 is not found anywhere in the database.
I've got a few ideas on how to solve this but I want to find one that
requires as little administrative overhead as possible.
1. I could add a field to the db for each product that would be used for
associated words for a product as well as misspellings.
PROS: Very customizable on an individual product level.
CONS: Would need to be updated for each and every product individually.
2. Make a field for each manufacturer's record for alternate
spellings/keywords.
PROS: Little administrative overhead.
CONS: Is only manufacturer name based and could not account for specific
products.
3. Both #1 and #2.
PROS: Flexible.
CONS: Lots of administrative overhead.
4. A one-to-many table that associates individual words with product
skus. This one is pretty much the opposite of #1 with one key
difference: the interface. It would be probably be easier to enter a
desired word and then choose each sku from a multi-select dropdown than
it would be to go from product to product entering one word at a time.
5. I'm not sure how this would be accomplished from a technical
standpoint but it would be nice to have the program know that when
someone types in "511" they really meant "5.11". Or (hopefully this
isn't a bad example) if they type in "dessert" (as in cake and icecream)
they really meant "desert" (as in snakes and sand).
In my case that wouldn't be a bad assumption since our site will never
contain the word desert unless it's a misspelling.
What does everyone think? What other options are out there?
Chris.
--- End Message ---
--- Begin Message ---
Not sure about the numbers but soundex could be useful
http://php.net/soundex
James
Chris W. Parker wrote:
Hello,
On my site right now if someone searches for "511" (a misspelling of the
manufacturer 5.11) they are not presented with the right products
because 511 is not found anywhere in the database.
I've got a few ideas on how to solve this but I want to find one that
requires as little administrative overhead as possible.
1. I could add a field to the db for each product that would be used for
associated words for a product as well as misspellings.
PROS: Very customizable on an individual product level.
CONS: Would need to be updated for each and every product individually.
2. Make a field for each manufacturer's record for alternate
spellings/keywords.
PROS: Little administrative overhead.
CONS: Is only manufacturer name based and could not account for specific
products.
3. Both #1 and #2.
PROS: Flexible.
CONS: Lots of administrative overhead.
4. A one-to-many table that associates individual words with product
skus. This one is pretty much the opposite of #1 with one key
difference: the interface. It would be probably be easier to enter a
desired word and then choose each sku from a multi-select dropdown than
it would be to go from product to product entering one word at a time.
5. I'm not sure how this would be accomplished from a technical
standpoint but it would be nice to have the program know that when
someone types in "511" they really meant "5.11". Or (hopefully this
isn't a bad example) if they type in "dessert" (as in cake and icecream)
they really meant "desert" (as in snakes and sand).
In my case that wouldn't be a bad assumption since our site will never
contain the word desert unless it's a misspelling.
What does everyone think? What other options are out there?
Chris.
--- End Message ---
--- Begin Message ---
Hi all!
I'm experiencing problems with using DOM component in PHP 4.4.0.
It works just fine on my localhost with PHP 5.0, but on host server PHP
4.4.0 used, and can't be updated to 5.0 for several reasons. Is there
any guided instruction how to make code using DOM (DOMDocument class,
etc.) component work?
Please guide me what can I do to make my code work without changing it?
Thank You!
==
Best Regards
Andrew Kachalo
http://www.geocities.com/andrew_kachalo/
--- End Message ---
--- Begin Message ---
Hi all!
I'm experiencing problems with using DOM component in PHP 4.4.0.
It works just fine on my localhost with PHP 5.0, but on host server PHP
4.4.0 used, and can't be updated to 5.0 for several reasons. Is there
any guided instruction how to make code using DOM (DOMDocument class,
etc.) component work?
Please guide me what can I do to make my code work without changing it?
Thank You!
==
Best Regards
Andrew Kachalo
http://www.geocities.com/andrew_kachalo/
--- End Message ---
--- Begin Message ---
> Please guide me what can I do to make my code work without changing it?
DOM implementation in PHP5 is completely new, and you can't have the same in
PHP4. I think that the most reasonable solution will be change the hosting to
another with PHP5 support...
Best regards.
--
Alessandro 'Aronnax' Rossini
----------------------------
web -> www.aronnax.it
e-mail -> [EMAIL PROTECTED]
icq -> 2442698
ZeroNotice IT Solutions -> www.zeronotice.com
pgpkslSSWVvnC.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
And what DOM library, which is compatible with PHP 5.0 and PHP 4.4 can
I use to avoid the conflict I currently have?
On жовт 27, 2005, at 23:32, Alessandro Rossini wrote:
Please guide me what can I do to make my code work without changing
it?
DOM implementation in PHP5 is completely new, and you can't have the
same in
PHP4. I think that the most reasonable solution will be change the
hosting to
another with PHP5 support...
Best regards.
--
Alessandro 'Aronnax' Rossini
----------------------------
web -> www.aronnax.it
e-mail -> [EMAIL PROTECTED]
icq -> 2442698
ZeroNotice IT Solutions -> www.zeronotice.com
==
Best Regards
Andrew Kachalo
http://www.geocities.com/andrew_kachalo/
--- End Message ---
--- Begin Message ---
The best solution is not to change your host at all but to change your
local version of PHP to 4,
PHP4 DOM - http://php.net/manual/en/ref.domxml.php
PHP5 DOM - http://php.net/manual/en/ref.dom.php
The PHP5 and PHP4 extensions are not compatible with each other.
~James
Andrew Kachalo wrote:
Hi all!
I'm experiencing problems with using DOM component in PHP 4.4.0.
It works just fine on my localhost with PHP 5.0, but on host server PHP
4.4.0 used, and can't be updated to 5.0 for several reasons. Is there
any guided instruction how to make code using DOM (DOMDocument class,
etc.) component work?
Please guide me what can I do to make my code work without changing it?
Thank You!
==
Best Regards
Andrew Kachalo
http://www.geocities.com/andrew_kachalo/
--- End Message ---
--- Begin Message ---
Ken Tozier wrote:
I'm having a major problem with what seems, on it's face, to be a
really basic array function.
What happens is on the browser end, I've written some javascript code
that packages up javascript variables in native PHP format and sends
the packed variables to a PHP script on the server via a POST and
XMLHTTP. On the server end, the PHP script grabs the packed variables
out of the $_POST, strips slashes and uses the "unserialize" command.
Here's the function that gets the post data
$unpacked_data = GetDataFromPOST();
And here's a var_dump of $unpacked_data as it appears in the browser
array(1) { ["handler"]=> array(1) { ["0"]=> string(9) "databases" } }
I'm able to get the "handler with no problem like so:
$parts = $unpacked_data['handler'];
Which yields the following var_dump
array(1) { ["0"]=> string(9) "databases" }
Here's where the problem starts. I've had no luck whatsoever trying to
get items of $parts. I've tried all of the following and each of them
return NULL
$part_1 = $parts[0];
$part_1 = $parts['0'];
$part_1 = $parts["0"];
$part_1 = $parts[48]; <- ASCII character for zero
In desperation, I also tried this
foreach($parts as $key => $value)
{
var_dump($key);
// => string(1) "0"
var_dump($value);
// => string(9) "databases"
$parts_1 = $parts[$key];
// => NULL;
}
But no luck
I also checked the type and size of the key like so
foreach($parts as $key => $value)
{
echo gettype($key);
// => string
echo sizeof($key);
// => 1
}
Anyone have any insights as to what the heck is going on here? This
should be a piece of cake but It's stopped me cold for a full day and a
half
Thanks for any help
Ken
Why the serialize/unserialize()? Don't serialize() on the client's and see what happens if you just print_r($_POST) as
received?
--- End Message ---
--- Begin Message ---
Jason Gerfen wrote:
I am having a problem with a couple of function I have written to check
for a type of string, attempt to fix it and pass it back to the main
function. Any help is appreciated.
<?php
/*
* ex. 00:AA:11:BB:22:CC
*/
function chk_mac( $mac ) {
if( ( eregi(
"^[0-9A-Fa-f]{2}\:[0-9A-Fa-f]{2}\:[0-9A-Fa-f]{2}\:[0-9A-Fa-f]{2}\:[0-9A-Fa-f]{2}\:[0-9A-Fa-f]{2}$",
$mac ) ) || ( !eregi( "^[0-9a-fA-F]$", $mac ) ) {
return 0;
} else {
return 1;
}
}
/*
* check validity of MAC & do replacements if necessary
*/
function fix_mac( $mac ) {
global $mac;
if( eregi( "^[0-9A-Fa-f-\:]$", $mac ) ) {
$mac1 = $mac;
echo "MAC: $mac1<br>";
}
/* strip the dash & replace with a colon */
if( eregi(
"^[0-9A-Fa-f]{2}\-[0-9A-Fa-f]{2}\-[0-9A-Fa-f]{2}\-[0-9A-Fa-f]{2}\-[0-9A-Fa-f]{2}\-[0-9A-Fa-f]{2}$",
$mac ) ) {
$mac1 = preg_replace( "/\-/", ":", $mac );
echo "MAC: $mac1<br>";
}
/* add a colon for every two characters */
if( eregi( "^[0-9A-Fa-f]{12}$", $mac ) ) {
/* split up the MAC and assign new var names */
@list( $mac_1, $mac_2, $mac_3, $mac_4, $mac_5, $mac_6 ) = @str_split(
$mac, 2 );
/* put it back together with the required colons */
$mac1 = $mac_1 . ":" . $mac_2 . ":" . $mac_3 . ":" . $mac_4 . ":" .
$mac_5 . ":" . $mac_6;
echo "MAC: $mac1<br>";
}
return $mac1;
}
// do our checks to make sure we are using these damn things right
$mac1 = "00aa11bb22cc";
$mac2 = "00-aa-11-bb-22-cc";
$mac3 = "00:aa:11:bb:22:cc";
$mac4 = "zz:00:11:22:ff:xx";
if( chk_mac( $mac1 ) != 0 ) {
$mac = fix_mac( $mac1 );
echo $mac1 . " converted to " . $mac . "<br>";
} else {
echo "$mac1 is valid.<br>";
}
if( chk_mac( $mac2 ) != 0 ) {
$mac = fix_mac( $mac2 );
echo $mac2 . " converted to " . $mac . "<br>";
} else {
echo "$mac2 is valid.<br>";
}
if( chk_mac( $mac3 ) != 0 ) {
$mac = fix_mac( $mac3 );
echo $mac3 . " converted to " . $mac . "<br>";
} else {
echo "$mac3 is valid.<br>";
}
if( chk_mac( $mac4 ) != 0 ) {
$mac = fix_mac( $mac4 );
echo $mac4 . " converted to " . $mac . "<br>";
} else {
echo "$mac4 is valid.<br>";
}
?>
For what it's worth..
I'm moderately good with regex; but, I wouldn't even try to get an expression like yours to work properly, with all
possiblities and exceptions.
Suggest breaking it up into several separate tests.
--- End Message ---
--- Begin Message ---
Hi,
Thursday, October 27, 2005, 3:15:30 AM, you wrote:
JG> I am having a problem with a couple of function I have written to check
JG> for a type of string, attempt to fix it and pass it back to the main
JG> function. Any help is appreciated.
I would do it with a small class like this:
<?php
class mac{
var $mac='';
var $is_valid = false;
function mac($mac){
$mac = preg_replace('/[^0-9A-F]/','',strtoupper($mac));
if($this->is_valid =
preg_match('/^(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})(\w{2})$/',$mac,$parts)){
array_shift($parts); //lose the first bit
$this->mac = implode(':',$parts);
}
}
}
//test
$mac_list =
array("00-aa-11-bb-22-cc","00:aa:11:bb:22:cc","zz:00:11:22:ff:xx","00 aa 11 bb
22 cc");
foreach($mac_list as $mac){
$mactest = new mac($mac);
echo "In:$mac";
if($mactest->is_valid){
echo " valid $mactest->mac\n";
}else{
echo " NOT valid\n";
}
}
--
regards,
Tom
--- End Message ---
--- Begin Message ---
Somewhere in the manual (damned if I can find it now) it says (or used
to say) that you can or can't safely do this:
while (list($k, $v) = each($array)){
if (...) unset($array[$k]);
}
I don't even remember if it's safe or not, but I swear I saw it not
that long ago...
Anyway, can you do *this* safely as a DOCUMENTED FEATURE:
foreach($array as $k => $v){
if (...) unset($array[$k]);
}
I'm sure I could test it and maybe find out if "it works" but is it
documented behaviour I can rely on? I'm sure not finding this in the
manual now that I go looking for it, though I know I saw it there
before.
PS
I'm being dragged kicking and screaming into using this new-fangled
'foreach' thing instead of while/list/each, and I don't really care
for it so far. :-)
--
Like Music?
http://l-i-e.com/artists.htm
--- End Message ---
--- Begin Message ---
Why should this be "unsafe" (whatever the heck that means) in any way? Of
course you can do it.
Regards,
Niels.
[sorry for mailing to your private address. wrong button :)]
> Anyway, can you do *this* safely as a DOCUMENTED FEATURE:
>
> foreach($array as $k => $v){
> if (...) unset($array[$k]);
> }
--- End Message ---
--- Begin Message ---
I am having problems decompressing a zlib'd string located in a file.
In the file headers, the compression says that it is zlib.
But, when I 'gzinflate' the string, I get the error: gzinflate():
data error in <b
Is the below NOT a zlib or some strange variant ?
anyone know ?
g
<?php
$hex="C0636D7664000003DE789C95533B4E0331109D2408C44FA200125084568212D153
2040A2A02012120D05142636BB26B677659B20B8000D05D7E00674882B70000EC1018019
67974D365060E569C76F3CEF4D66BD008D779DA67D0050BA9F707CC2CBFDE43301A07E1A
5003FA956B6433BEDFFB89A87E6CD5011AF3DEB21EC667BE173C1BA567A156D67E7DFEC3
772207C086E0DEE1B32D94F36545AE1B6AEB4673C9308834FFE3BF031C227613AE2CE575
A2ACCBAC6759A6824AADF6BA769259E945B46FA4665EA626EA08948D0E99E14A60597D4A
4B734936B10E36AD188941CF5F61E5ED6D17361C6D98928E6C1606366FAD7DDCA08B92CC
4507CC0F19C0061F18B4B9159743D39923913C7E74FE827ADE74DEF1A133EDBF270A2DE7
C30C8B5C31BF366A7447F91F2C62EE6E909A7928B96E5A79071FDD948B8ADFBB13CCE435
D339B78A10BFF406B04C2F642443510BD1AB9CA77809910CF3057955155FEAE1D5A99264
A6C6DAA07A5915A50EE2CA51BA93CD6BEEE9B6CD1AA605B73A4F9DE7F4FA93BBB1D004E8
302EA21BE993E848F6C58967B1888E2DCD6F2553D7B14EFB5290C40E6A6CE9F0F1CE75FD
6D665243839ACE14BB0DCADFAFDD8C760000003C";
// Convert the hex to a string
$string = pack("H*", $hex);
//echo it
echo "the compressed string is:". "\r\n";
echo $string;
//decompress the string
$uncompressed =gzinflate($string);
echo "the uncompressed string is: ".$uncompressed;
?>
The Output SHOULD look something like this: