Re: [PHP] Which file Included me?

2009-02-22 Thread RottenEye
But we could use rawurlencode($_SERVER['PHP_SELF']), no? João Michael A. Peters wrote: Nisse Engström wrote: On Wed, 18 Feb 2009 10:37:53 -0800, Michael A. Peters wrote: http://www.gfx-depot.com/forum/-php-server-php-self-validation-t-1636.html explains a technique to validate the input

Re: [PHP] Which file Included me?

2009-02-19 Thread Nisse Engström
On Wed, 18 Feb 2009 10:37:53 -0800, Michael A. Peters wrote: http://www.gfx-depot.com/forum/-php-server-php-self-validation-t-1636.html explains a technique to validate the input as well (don't trust that is clean) Amazing! Not once did they mention htmlspecialchars(). /Nisse -- PHP

Re: [PHP] Which file Included me?

2009-02-19 Thread Michael A. Peters
Nisse Engström wrote: On Wed, 18 Feb 2009 10:37:53 -0800, Michael A. Peters wrote: http://www.gfx-depot.com/forum/-php-server-php-self-validation-t-1636.html explains a technique to validate the input as well (don't trust that is clean) Amazing! Not once did they mention

[PHP] Which file Included me?

2009-02-18 Thread Ed Curtis
Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every page of a site but also needs to include some javascript only if it's called from a certain URL.

Re: [PHP] Which file Included me?

2009-02-18 Thread APseudoUtopia
On Wed, Feb 18, 2009 at 1:16 PM, Ed Curtis e_cur...@homes2see.com wrote: Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every page of a site but also

Re: [PHP] Which file Included me?

2009-02-18 Thread Sudheer
Ed Curtis wrote: Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every page of a site but also needs to include some javascript only if it's called from

Re: [PHP] Which file Included me?

2009-02-18 Thread Robert Cummings
On Wed, 2009-02-18 at 23:57 +0530, Sudheer wrote: Ed Curtis wrote: Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every page of a site but also

Re: [PHP] Which file Included me?

2009-02-18 Thread Michael A. Peters
Ed Curtis wrote: Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every page of a site but also needs to include some javascript only if it's called from

Re: [PHP] Which file Included me?

2009-02-18 Thread Michael A. Peters
Ed Curtis wrote: Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every page of a site but also needs to include some javascript only if it's called from

Re: [PHP] Which file Included me?

2009-02-18 Thread Shawn McKenzie
Michael A. Peters wrote: Ed Curtis wrote: Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every page of a site but also needs to include some javascript

Re: [PHP] Which file Included me?

2009-02-18 Thread Sudheer
Robert Cummings wrote: On Wed, 2009-02-18 at 23:57 +0530, Sudheer wrote: Ed Curtis wrote: Is there a function or variable that will tell me if a file has asked another file to include something much the same as $_SERVER['HTTP_REFERER'] works. I have a script that is included on every

Re: [PHP] Which file Included me?

2009-02-18 Thread Dotan Cohen
http://www.gfx-depot.com/forum/-php-server-php-self-validation-t-1636.html explains a technique to validate the input as well (don't trust that is clean) I do not understand the exploit. How is he spoofing any $_SERVER variables? The attack description doesn't make sense. -- Dotan Cohen

Re: [PHP] Which file Included me?

2009-02-18 Thread Michael A. Peters
Dotan Cohen wrote: http://www.gfx-depot.com/forum/-php-server-php-self-validation-t-1636.html explains a technique to validate the input as well (don't trust that is clean) I do not understand the exploit. How is he spoofing any $_SERVER variables? The attack description doesn't make sense.

Re: [PHP] Which file Included me?

2009-02-18 Thread Shawn McKenzie
Dotan Cohen wrote: http://www.gfx-depot.com/forum/-php-server-php-self-validation-t-1636.html explains a technique to validate the input as well (don't trust that is clean) I do not understand the exploit. How is he spoofing any $_SERVER variables? The attack description doesn't make

Re: [PHP] Which file Included me?

2009-02-18 Thread Shawn McKenzie
Michael A. Peters wrote: Dotan Cohen wrote: http://www.gfx-depot.com/forum/-php-server-php-self-validation-t-1636.html explains a technique to validate the input as well (don't trust that is clean) I do not understand the exploit. How is he spoofing any $_SERVER variables? The attack

Re: [PHP] Which file Included me?

2009-02-18 Thread Dotan Cohen
Did you actually try his example? No, I could not understand it. Now I see why: 1) Where would the experienced hacker enter the attack? Now I see that it is the URL of the attacked site. That was not clear, I though that it was being entered into some form element that I did not see in the code.