Geek Answers Handbook

Trick a PHP file into thinking that it is one in this directory

I am developing a thing where I will have two very different components.

The structure at the moment is Core:
Material inside the core
3prty:
The third participant developed the material

Now I want a third party to develop a php script to do something like

scandir("../");

or

 require "../core/anyfile.php";

or

 file_get_contents("../core/SourceCode.php");

In any case, for this to happen? Any help is appreciated. Thanks in advance.

I am running Apache and my own server, so I can configure any extension, etc. The solution should be viable to extend the production, and I should be able to allow a third-party script, knowing that they can be malicious.

+7
security php
source share
2 answers

It looks like installing open_basedir for a third-party directory. This will not allow third-party scripts to “know” about other 3P scripts, but it will prevent access to the kernel or any external system files.

+1
source share

It really depends a lot on the server side server configuration. Take apache, for example, your Apache threads will run as the system user defined in the User directive (usually something like _www, www-data or apache) found in your httpd.conf file. If your project includes files from your provider at any time, they will be executed with the same user (thus, with the same permission level) as the main files, giving them access to read everything.

I believe that the only way to achieve what you offer is to completely separate the main and vendor libraries that manually change the current user, and then run the vendor libraries as separate executions. Suppliers need to support this interaction. This can be quite frustrating, although I would not recommend it in a production environment (can be handled by vendor libraries if they are harmful):

 <?php $restricted_user = 'vendor'; $user_info = posix_getpwnam($restricted_use); // change the user before executing the external vendor scripts posix_setuid($user_info['uid']); posix_setgid($user_info['gid']); // run the vendor scripts using exec, shell_exec, system, pass_thru... system('php /path/to/vendor/script.php');

Generally speaking, it is a bad idea to allow any executable code on your server whose execution patterns you do not trust.

0
source share

More articles:


All Articles