FUDforum: comp.lang.php

Home » Imported messages » comp.lang.php » Nested PHP

Show: Today's Messages :: Polls :: Message Navigator

Re: Nested PHP [message #185313 is a reply to message #185309]

Mon, 17 March 2014 15:33

The Natural Philosoph
Messages: 993
Registered: September 2010

Karma:

Senior Member

On 17/03/14 14:26, Arno Welzel wrote:
> Am 03.03.2014 12:38, schrieb The Natural Philosopher:
>
>> On 02/03/14 14:54, Arno Welzel wrote:
>>> Adrian Tuddenham, 2014-02-10 21:24:
>>>
> [About eval()]
>>> I recommend to think about what you want to solve and if it is really
>>> neccessary to create "dyanamic" PHP on the fly.
>>>
>> Nice thing about evalled code is that you can stick it in a database..
>
> You call it "nice" to put *code* in a database? I would call it an ugly
> hack.
>

That is because what you are trying to achieve is not necessarily what I
am trying to achieve.

What does a data base do well?
- breaks the directory hierarchy of data
- moves the data outside of the actual era directly accessible to te web
server
- provides a one point of backup
- adds a security of access to the data and code not easily done in
other ways.

In what I am working on, the advantages massively out weigh the
disadvantages. Depending on the user login on this uber secure site, not
only can they not see certain data, but the programs they can even
execute are different, at three levels - I can configure them not to be
accessible in any menus, and more to the point, even knowing their URL
doesn't help, because to a user without permissions they are not just
not executable, they don't actually exist - the server will return a
'not found' if they try.

And at the third level I can set SQL permissions so that if a program
bug renders than accessible, they cant be loaded with the SQL
permissions the user has either. So that will throw a PHP/SQL errors and
that helps me trace when I have the wrong code operating.

It gets better. Simply uploading malware into the web server hierarchy
wont change the way the site behaves. Code has to be uploaded through a
custom interface that isn't even on the same site as the web server, and
all code changes can be recorded in the same database.

Code and data are separately modified through secure programs designed
to allow just enough access to do the job. The code and data are not
mixed up so that any person 'designing a website' can screw the whole
operation up accidentally.

> I know, some products like vBulletin do this in production environments
> - they put all their plugins and some other stuff in the database.
>
> But this does not mean this is "nice" nor even something you want. Even
> WordPress does not try to put code into the database ;-)
>

What you want depends on what you are building.

Wordpress has to work in a situation where all you have is an
administrative front end or a an ftp access TO THE SAME SITE in place.

That is already completely broken security wise.

I only administer the PUBLIC site and code via a secure encrypted
connection to another site entirely.

Now that doesn't necessarily necessitate moving the code from a private
hierarchy visible to PHP alone, but the ability to completely map any
URL to any piece of code as well as to utterly disguise the fact that it
is actually PHP in play, is very handy.

It also means that in the limit I can encrypt the code in the database.

All bar the decryption algo of course..and that means that even the
sysadmins on the machine in its data centre cant have simple easy
accidental access in a Snowden kind of way to reveal much about the site.

They can't say 'we were routinely exposed to the data' any attempt to
decode it has to be a deliberate de facto criminal act.

In my case its a way to access intensely private and sensitive data in
the most secure and hack proof way possible whilst still having the
ability to expose very selected parts of it to the pubic at large, and
its also provides very de-skilled tools to manage that data at various
different levels, and many tools to allow the monitoring of who is
changing the code or data, when, and what IP address they are using.

Its a very secure very private cloud.

> This is only a hack for situations where a plugin installer in the
> administrative backend may not be able to write the files.
>
> Some may this even call more "secure" since you can set the folder
> permissions more restrictive. Some may call this more "comfortable"
> since you don't need to give the web server permissions to write to the
> document root. But in the end - it doesn't matter if an attacker is able
> to overwrite files or overwrite database content, and securing the
> database is not as easy as protecting the filesystem.
>
>
The important thing is that it should be very very hard for an attacker
to gain any foothold without being detected.

Unless he manges to gain root access to the actual server, in my case
the ONLY way is to use the 'staff entrance' which is very heavily
monitored.

I am not saying he can't get root access, but every way that he might
has at least one trap set.

At the moment the weak point is that the server is only a virtual
private server, in someone elses machine room on someone else's
hardware., and beyond the prototype I can envisage it being on a
securely-located-in-customers-own-premises physical machine on the end
of a high speed line.

That removes the major secuity hazard of outsourced hosting.

>

--
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to
lead are elected by the least capable of producing, and where the
members of society least likely to sustain themselves or succeed, are
rewarded with goods and services paid for by the confiscated wealth of a
diminishing number of producers.

Report message to a moderator

[Message index]

		Nested PHP By: adrian on Mon, 10 February 2014 20:24
		Re: Nested PHP By: Jerry Stuckle on Mon, 10 February 2014 20:56
		Re: Nested PHP By: adrian on Mon, 10 February 2014 21:44
		Re: Nested PHP By: Jerry Stuckle on Mon, 10 February 2014 21:51
		Re: Nested PHP By: Peter H. Coffin on Tue, 11 February 2014 14:14
		Re: Nested PHP By: Jerry Stuckle on Tue, 11 February 2014 14:27
		Re: Nested PHP By: Peter H. Coffin on Wed, 12 February 2014 00:41
		Re: Nested PHP By: Jerry Stuckle on Wed, 12 February 2014 01:03
		Re: Nested PHP By: adrian on Wed, 12 February 2014 10:13
		Re: Nested PHP By: Tim Streater on Wed, 12 February 2014 10:33
		Re: Nested PHP By: Jerry Stuckle on Wed, 12 February 2014 11:30
		Re: Nested PHP By: adrian on Wed, 12 February 2014 12:52
		Re: Nested PHP By: The Natural Philosoph on Wed, 12 February 2014 13:11
		Re: Nested PHP By: Denis McMahon on Thu, 13 February 2014 06:55
		Re: Nested PHP By: Peter H. Coffin on Thu, 13 February 2014 18:02
		Re: Nested PHP By: Stefan+Usenet on Wed, 12 February 2014 12:14
		Re: Nested PHP By: The Natural Philosoph on Mon, 10 February 2014 22:09
		Re: Nested PHP By: Christoph Michael Bec on Mon, 10 February 2014 22:23
		Re: Nested PHP By: Tim Streater on Mon, 10 February 2014 22:27
		Re: Nested PHP By: Geoff Muldoon on Mon, 10 February 2014 22:30
		Re: Nested PHP By: Denis McMahon on Mon, 10 February 2014 23:06
		Re: Nested PHP By: Jerry Stuckle on Tue, 11 February 2014 01:46
		Re: Nested PHP By: adrian on Tue, 11 February 2014 10:11
		Re: Nested PHP By: Tim Streater on Tue, 11 February 2014 11:17
		Re: Nested PHP By: adrian on Tue, 11 February 2014 12:01
		Re: Nested PHP By: Tim Streater on Tue, 11 February 2014 12:45
		Re: Nested PHP By: Christoph Michael Bec on Tue, 11 February 2014 12:55
		Re: Nested PHP By: Denis McMahon on Tue, 11 February 2014 13:29
		Re: Nested PHP By: adrian on Tue, 11 February 2014 14:31
		Re: Nested PHP By: Denis McMahon on Tue, 11 February 2014 17:24
		Re: Nested PHP By: Jerry Stuckle on Tue, 11 February 2014 13:15
		Re: Nested PHP By: adrian on Tue, 11 February 2014 14:31
		Re: Nested PHP By: Jerry Stuckle on Tue, 11 February 2014 15:10
		Re: Nested PHP By: adrian on Tue, 11 February 2014 15:31
		Re: Nested PHP By: Jerry Stuckle on Tue, 11 February 2014 16:24
		Re: Nested PHP By: adrian on Wed, 12 February 2014 10:13
		Re: Nested PHP By: Jerry Stuckle on Wed, 12 February 2014 11:33
		Re: Nested PHP By: Ben Bacarisse on Tue, 11 February 2014 15:26
		Re: Nested PHP By: Ben Bacarisse on Tue, 11 February 2014 14:41
		Re: Nested PHP By: adrian on Tue, 11 February 2014 15:31
		Re: Nested PHP By: Ben Bacarisse on Tue, 11 February 2014 15:53
		Re: Nested PHP By: Jerry Stuckle on Tue, 11 February 2014 16:26
		Re: Nested PHP By: bill on Tue, 11 February 2014 12:12
		Re: Nested PHP By: Mr Oldies on Wed, 12 February 2014 14:33
		Re: Nested PHP By: Denis McMahon on Thu, 13 February 2014 06:47
		Re: Nested PHP By: Scott Johnson on Thu, 13 February 2014 13:01
		Re: Nested PHP By: Evan Platt on Fri, 14 February 2014 15:19
		Re: Nested PHP By: Scott Johnson on Fri, 14 February 2014 18:43
		Re: Nested PHP By: Arno Welzel on Sun, 02 March 2014 14:54
		Re: Nested PHP By: adrian on Sun, 02 March 2014 18:10
		Re: Nested PHP By: The Natural Philosoph on Mon, 03 March 2014 11:38
		Re: Nested PHP By: Arno Welzel on Mon, 17 March 2014 14:26
		Re: Nested PHP By: Jerry Stuckle on Mon, 17 March 2014 14:52
		Re: Nested PHP By: The Natural Philosoph on Mon, 17 March 2014 15:33
		Re: Nested PHP By: Peter H. Coffin on Mon, 17 March 2014 22:10
		Re: Nested PHP By: The Natural Philosoph on Mon, 17 March 2014 23:01
		Re: Nested PHP By: Christoph Michael Bec on Mon, 17 March 2014 23:31
		Re: Nested PHP By: The Natural Philosoph on Tue, 18 March 2014 13:10
		Re: Nested PHP By: Gabriel on Mon, 17 March 2014 15:18

Previous Topic:	Filling an array with random input doesn't quite work
Next Topic:	string length

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Sun Nov 24 01:06:04 GMT 2024

Total time taken to generate the page: 0.04345 seconds