Belt (and suspenders?) protection?

[jwernerny]

Now that the patches have been stabilzed for a few days, I decided to go back in and fix remove my even more brutal absolute path hack. Okay, the fact that the absolute path was breaking things also had some influence.

I noticed two interesting things.

1. $phpbb_root_path is used two different ways. One way is for machine local access where an absolute directory path on the server will work. The second is a relative path in a URL. 15+ years of writing code says this is a great recipe for disaster.

2. Many files still don't contain the simple

Code: Select all

if ( !defined('IN_PHPBB') ){    die('Hacking attempt');}

block.

Before I go off and stick that code in all of the files, particularly in include, is there something I might break?

Are any of the other files vulnerable?

Did I just tell everyone how to do the next hack?

- John

2.

[found it]

I have added that code to all my files in the include folder and have not experianced any problems with my site as of yet...

[Michaelo]

I a nut shell... If a hacker knows there is a function in a file, its name and params and a way to utilise it to hack by calling it directly, the die hacking attempt code will prevent this from happening...

I have wondered about this many many time, and came to the conclusion that those coder guy in phpBB (and all the other bb's) know best... They have not added it to every file so I guess it is not needed... or perhaps by adding it I could do some harm... Bull add it... at worst you will get an error message down the road and at best it might stop a hack...

One other thing that might prove worthwhile is adding a number to each instance of the 'die hacking', so the report would indicate which file was responsible... As in die("Hacking attempt #24"); incidentally no one will know which file it is except you...

Mike

[found it]

One other thing that might prove worthwhile is adding a number to each instance of the 'die hacking', so the report would indicate which file was responsible... As in die("Hacking attempt #24"); incidentally no one will know which file it is except you...

Mike

An excellant idea


I will add it to mine now...