[thelist] os commerce instal

[Andrew Maynes]

just to follow up on the globals off situation I guess everyone had read this
but incase you haven't
http://php.ca/manual/en/security.registerglobals.php

Andrew



so this would explain how the hackers that attacked one of my phpbb forums got
in.  They downloaded the script and went though it untill they found something
they could exploit..... makes sense!

So hackers 'crackers' will have a copy of Oscommerce and are looking for
vunerablilities I guess.

cheers
Andrew

>Funny I was just writing a mail about this.  What are the reasons for not
have
>globals on?

Security is the main reason. Having globals set to On makes it easier for a
malicious user to set variables in your scripts by putting them in the query
string. This attack depends on how badly your script is coded and it also
relies on guessing the correct variable name but here is a simplistic
example...

<?
// This is a bad script
if (!$admin) {
	echo 'No acccess allowed';
	exit();
}

// Admin only stuff happens here
...
?>

An attacker could call your script with ?admin=yes as a query string. With
register_globals on the attacker would then have access to the admin
functions. With globals off the $admin var would not be set so the script
would work as intended.

HTH
Rich


---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.410 / Virus Database: 231 - Release Date: 31/10/2002