2
\$\begingroup\$

Here is something I've been working on today..

I been trying to determine how to build a website, that has a form, and that form allows a user to make a simple URL to give out. In the future it will also create a website, or possible websites (based off of varying templates that I have built for it).

I just started trying to understand this today, so bear with me...

So far, as far as I am aware, all of the code works and accomplishes the following:

  • Allows a user to input a Website name.. I keep both a version with spaces, and a version without spaces.
  • It creates a directory for that name with no spaces, and it creates a index.php in that directory.
  • It then displays the link to said directory(will not work on this code because I use a generic primary domain name).

Example Test Domain:

www.PrimaryDomain.com/Test/

Example User Input:

$_POST['Dir'] = 'Test User Domain';
<?php
//Make sure server is in post mode
if($_SERVER['REQUEST_METHOD'] != 'POST')
    {
        //display form
        echo'<form name="" action="" method="post" class="wpcf7-form" >';
            echo'<input name="Dir" type="text" placeholder="Username" required autofocus>';
            echo'<input type="submit" value="Start" class="wpcf7-form-control wpcf7-submit">';
        echo'</form>';
    }
else
{
    //Specify the URL
    $Name = mysql_real_escape_string($_POST['Dir']); //form data
    $CurrentDir = getcwd(); //current directory
    $URL = ''.$CurrentDir.'/'.$Name.'/'; //New url to create

    //Speciy the file to create
    $Index_file = ''.$URL.'index.php'; //location of new index.php file

    //Remove the spaces, and make each it's own variable
    $Index_file = str_replace(' ', '', $Index_file); //the location of index.php
    $Dir_No_Space = str_replace(' ', '', $URL); //the main directory
    $Name_No_Space = str_replace(' ', '', $Name); //the form data the user entered

    mkdir('/'.$Dir_No_Space.'', 0777, true); //make the directory
    $handle = fopen($Index_file, 'w') or die('Cannot open file:  '.$Index_file); //Create the index.php File

    //Source code of the File: index.php
    $index_data = '

    <html>
        <head>
        </head>
        <body>
            <p>This is an example</p>
        </body>
    </html>

    ';

    fwrite($handle, $index_data); //write the source code to the index.php file

    //Check the Document Creation
    if(!fwrite)//if error
        {
        echo'Error <br>';
        echo mysql_error(); //debugging
        }

    else//if not error
        {
        //tell the user how to access the new page
        echo'<p>This is a test in progress for '.$Name.' View @ <a href="http://www.PrimaryDomain.com/Test/'.$Name_No_Space.'/">www.PrimaryDomain.com/Test/'.$Name_No_Space.'/</a>.';
        }
}
?>

What do you guys/gals think? Is there a better method for this?

\$\endgroup\$
  • 1
    \$\begingroup\$ Is it hidden? Is it safe? \$\endgroup\$ – Mast Apr 23 '15 at 19:42
  • \$\begingroup\$ Is what hidden? It seems safe at the moment, the only input I currently take from the user is $Name = mysql_real_escape_string($_POST['Dir']); //form data \$\endgroup\$ – Jason Apr 23 '15 at 19:44
  • \$\begingroup\$ @Jason I think the main question is what you want to achieve with this. Who's going to be allowed to access this script? Is there some kind of authentication? Because currently, it's vulnerable to directory traversal and XSS. Once you actually allow input to be written to a PHP file, it will also be vulnerable to code execution. You can defend against the first two attacks, but if you allow users to write directly into PHP files, you need to trust them, there's no way to secure it. \$\endgroup\$ – tim Apr 23 '15 at 20:18
  • \$\begingroup\$ @tim I intend on there being an account system associated with this. This particular set of code is on a computer in an internal network that does not host to the interwebs while I write, test, and work on it. SO at the moment only fellow co-workers, and myself have access to it. Only after the site is fully complete will it be released to the gerneral public. Accounts will also need to have a certain level or privilege in order to utilize this particular feature. \$\endgroup\$ – Jason Apr 23 '15 at 20:30
4
\$\begingroup\$

It's bizarre that you are calling mysql_escape_string() and mysql_error() for code that has nothing to do with MySQL. Why are you calling arbitrary escaping functions? You should always know why you are escaping a string.

The most severe problem is that you don't validate the $_POST['Dir']. If the file path contains ../, then the script will overwrite any file of the attacker's choosing, subject only to the permissions of the webserver process.

The space/no-space scheme is baffling. Why are you doing that? You should either eliminate all characters that fall outside a safe set (e.g. A-Z, a-z, 0-9, dot, hyphen, and underscore), or diligently apply percent-encoding to URLs.

\$\endgroup\$
  • \$\begingroup\$ it's only possibly to override any index file (null byte poisoning isn't possibly anymore in newer PHP versions). But I agree with all the other points. It's important to know what you are defending against and when to use which defense mechanisms. It should also be noted that the code is currently vulnerable to XSS. \$\endgroup\$ – tim Apr 23 '15 at 20:09
  • \$\begingroup\$ and this is why I went here.. thanks for the help eveyone. \$\endgroup\$ – Jason Apr 23 '15 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.