8
Replies
Sorry my bad i apologise.... i am not a complete novice to coding in general
but i am new to php and web code, i do know quite a lot about the injection attacks and other security issues from other articles etc.
this code .... and i agree and for all you other folks that think this is ok.... this script ....IS MOST DEFINATLY NOT SECURE...
The rest of my site is and it has been tested
this one script is causing me an issue, and i have been trying to make it secure... but when i use the restrict access to page server behaviour the browser seems to have an issue, its like it tried to download the actual script rather then the document.
it produces the following error (attached image)
remove the behaviour and it works fine, so i was thinking that when the script runs it opens a new session... and does not use the current variables.
if the behaviour works the person accessing the script would have to be logged in to download the file.
here is the code with the behaviour inserted.. i just cant figure out whats going on....
<?php
if (!isset($_SESSION)) {
session_start();
}
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";
// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) {
// For security, start by assuming the visitor is NOT authorized.
$isValid = False;
// When a visitor has logged into this site, the Session variable MM_Username set equal to their username.
// Therefore, we know that a user is NOT logged in if that Session variable is blank.
if (!empty($UserName)) {
// Besides being logged in, you may restrict access to only certain users based on an ID established when they login.
// Parse the strings into arrays.
$arrUsers = Explode(",", $strUsers);
$arrGroups = Explode(",", $strGroups);
if (in_array($UserName, $arrUsers)) {
$isValid = true;
}
// Or, you may restrict access to only certain users based on their username.
if (in_array($UserGroup, $arrGroups)) {
$isValid = true;
}
if (($strUsers == "") && true) {
$isValid = true;
}
}
return $isValid;
}
$MM_restrictGoTo = "index.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {
$MM_qsChar = "?";
$MM_referrer = $_SERVER['PHP_SELF'];
if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
if (isset($_SERVER['QUERY_STRING']) && strlen($_SERVER['QUERY_STRING']) > 0)
$MM_referrer .= "?" . $_SERVER['QUERY_STRING'];
$MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
header("Location: ". $MM_restrictGoTo);
exit;
}
?>
<?php require_once('Connections/connTracker.php'); ?>
<?php
// if id is set then get the file with the id from database
if(isset($_GET['docindex']))
{$id = $_GET['docindex'];
$query = "SELECT document_name, document_type, document_size, document_content " .
"FROM tracker_documents WHERE document_index = ".$id;
$result = mysql_query($query) or die('Error, query failed');
list($name, $type, $size, $content) = mysql_fetch_array($result);
header("Content-length: $size");
header("Content-type: $type");
header("Content-Disposition: attachment; filename=$name");
echo html_entity_decode ($content);}
exit;
?>
AdChoices