Wherever we drop .htaccess stopping PHP running we can drop this file as well, use it in <img src="tricky.php">. 'Cos the result of this trickery is such a file that will produce the same valid PNG if PHP runs and if it doesn't but it will also drop a drupaltest file in the system temporary directory.
php -r 'file_put_contents("x.png", base64_decode("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQABDQottAAAAABJRU5ErkJggg=="));'
pngcrush -force -text b comment '<?php header("Content-type: image/png"); file_put_contents(sys_get_temp_dir(). "/drupaltest", ""); print(substr(file_get_contents(__FILE__), 49)); exit; // ' x.png tricky.php
rm x.png
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | tricky.zip | 388 bytes | chx |
Comments
Comment #1
chx commentedI have attached the result, in a zip file to make 100% sure it won't be corrupted when downloaded.
Comment #2
grendzy commentedThis is a really cool idea. I did find two problems:
Edit - tested on a second Mac, 10.6.7 / PHP 5.3.4, and it produces the same "?" output. Works fine with 5.2.14 compiled via MacPorts.
Comment #3
chx commentedI do not care too much about outside observers -- this will be an image on the install / status report screen. You mean it could be used as a probe before an attack? We can always write it out to disk just before we omit the image and then delete it later. I presume the page using this image will need to reload itself to check whether the image ran or not and that's when you can delete it.
Let's investigate more of that OS X problem.
Comment #4
cashwilliams commentedSubscribe.
I'm running OSX and will start investigating too.
Comment #5
chx commentedAlso, i can happily change header("Content-type: image/png"); to header("Content-type: application/x-httpd-php"); . Your move :)
Comment #6
grendzy commentedEven if the MIME type is changed, I don't think it will be possible to get all the headers to match exactly. Also there's no IANA standard type for PHP, so it can vary across different servers.
Unless we're willing to advertise sites that have this configuration flaw, I think it's best to prevent the test file from being observed. And I hate to be a buzzkill, but if the file isn't observable there may not be a need for the tricky polyquine. Something simple like
print strrev('!regnad');(fetched via drupal_http_request, or maybe XHR) might be just as effective.Date: Fri, 24 Jun 2011 15:43:40 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/1.0.0d DAV/2 PHP/5.2.14
Last-Modified: Fri, 24 Jun 2011 15:43:00 GMT
ETag: "1449857-f4-4a6770e6a2900"
Accept-Ranges: bytes
Content-Length: 244
Connection: close
Content-Type: application/x-httpd-php
Date: Fri, 24 Jun 2011 15:43:15 GMT
Server: Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/1.0.0d DAV/2 PHP/5.2.14
X-Powered-By: PHP/5.2.14
Content-Length: 244
Connection: close
Content-Type: image/png
Comment #7
chx commenteddrupal_http_request does not work. We tried and we have learned the bitter lesson you can't HTTP request yourself. XHR might work. But an image is the simplest and surest way and since it exists, why not?
Once again: if you have trouble with the file existing then the installer can write it out at the same time as settings.php -- there we have a writeable dir which can execute php.
Comment #8
chx commentedComment #22
smustgrave commentedThank you for sharing your idea for improving Drupal.
We are working to decide if this proposal meets the Criteria for evaluating proposed changes. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or there is no community support. Your thoughts on this will allow a decision to be made.
Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.
Thanks!
Comment #23
smustgrave commentedwanted to bump 1 more time.