|
PHP - Relatively Secure Server To Server Communication
I have two servers: WebServer and FaxServer. WebServer needs to send a fax. Is my approach shown below fairly secure?
Before sending a fax, ServerWeb needs to store a record in a table representing the message, and I am using a pseudo random value for the PK which is generated as 2147483648+mt_rand(-2147483647,2147483647). WebServer then generates a hash equal to hash('sha256',$pk.'secretCodeWhichOnlyWebServerAndFaxServerKnow'). WebServer then sends curl request to FaxServer using POST which includes $pk, the hash, the fax number, some text to include in the fax, and an optional array of document to include (array(array('id'=>321,'name')=>'fileName.pdf')). FaxServer verifies that the hash is correct given $pk, that the minimum information has been received, and that the fax number is a valid phone number, and quickly responds to WebServer by echoing 0 or 1 so the code in the WebServer could continue and inform the user. If all looks okay, a new instance of PHP is started.
if(missingInformation) {echo(0);}
else {
session_start();
$_SESSION['_xfr']=$_POST;
exec('/usr/bin/php -q /path/to/send_fax.php '.session_id().' >/dev/null &');
echo(1);
}
New instance of PHP send_fax.php then does the following:
session_id($argv[1]);//Set by parent
session_start();
$data=$_SESSION['_xfr'];
$doc_list=null;
foreach ($data['documents'] AS $doc)
{
if(ctype_alnum($doc['id']))
{
$file='/some/tmp/directory/'.$doc['id'];
if(!file_exists($file))
{
$url='http://machine.WebServer.com/index.php?task=displayDocument&id='.$doc['id'].'&x='.hash('sha256','displayDocument'.$doc['id'].'secretCodeWhichOnlyWebServerAndFaxServerKnow');
$cmd='wget -O '.$file.' '.escapeshellarg($url);
exec($cmd);
}
$doc_list.=' '.$file;
}
exit('invalid document');
}
//Send the fax...
//Send another CURL request to the WebServer similar to the wget giving the fax status.
exit;
When WebServer receives the wget request for a document, it confirms the hash and sends the document to the FaxServer using X-Sendfile.When WebServer receives the CURL request regarding status, it updates the database for the applicable message. Seem reasonably secure? Similar TutorialsHi, I need to make web site, which will get requests from users that log in and activate those scripts. But, the problem is that the server has to, when the script is activated, send request to another PC with the static IP address. Then, that PC should execute the script, send its results to server, and then the server will notice user who activated it (clicked on the link). So, the main problem is that server - client (static ip) communication, when the server is the first who sends request, not the client. Any instructions would be appreciated, thanks in advance. Hi my website has been working all day now everypage is getting this error also get the same error when i try to login into phpmyadmin Lost connection to MySQL server at 'reading initial communication packet', system error: 111 is this most likely a problem with the server? This topic has been moved to Third Party PHP Scripts. http://www.phpfreaks.com/forums/index.php?topic=353212.0 Hi there! I have two different hosting services: on the first one I can regularly use the function mail(), but the second does not allow me to send mails (it will block the account for mass mailing). I need to use mail to notify things to user who requested it, so I need to be able to send mail from this second server too. I thought that I will create a mailer script on the firs server, so that the second will simply call the script when needed, passing the e-mail addresses, the subject and content trough POST. Now, how to avoid that some malicious user uses my script to send own mails? I thought that I can send with the POST two vars, "time" and "secure_code" (I will eventually fake the names, so that is not so easy to recognize), where "time" is get by time(), and "secure_code" is a function depending on the value of "time". The mailer script gets the both values, and use the same function to verify if the "secure_code" is correct, according to time. Question is, is this safe? What kind of function shall I use? Also, how could I avoid that a malicious user simply same the "time" and "secure_code" in a certain moment, and use it again? Thanks in advance. Hi Little Help Needed I have created a new website In the index.php file i want to show records from database Now, here is how the problem arise I want to import codes from github intead of hosting those files on my server because i want to keep it opensource Below is the code I am using <?php // connect to the database include('connect-db.php'); // get results from database $sql = "SELECT id, upadhi, name FROM munishri"; $result = $conn->query($sql); if ($result->num_rows > 0) { // output data of each row while($row = $result->fetch_assoc()) { echo "id: " . $row["id"]. " - Name: " . $row["upadhi"]. " " . $row["name"]. "<br>"; } } else { echo "0 results"; } // close connection $conn->close(); ?> Can i host the code to show result in another file and use something like <?php // connect to the database include('connect-db.php'); // get results from database include('http://rawgit.com/th...database.php'); ?> I have a PHP web system that store in a windows server. In the system, there is a function for user to upload files to another server (Shared server in Unix). When i try to upload a file, it gives warning: Warning: move_uploaded_file(\\unixserver/sharedfolder/upload/test.txt) [function.move-uploaded-file]: failed to open stream: Permission denied in C:\wamp\www\upload\index.php on line 40 For your information, my username has been assigned in xxx's group that has access to read and write on that folder. Besides, i'm able to open,create and delete files on that folder's server manually (samba). The safe mode setting is off. Does anybody has any idea why this thing happen? I'm trying to make a simple website where people register to my website. When the user doesn't fill anything inside the boxes they get a message "Please fill all required fields" on the register.php page On my local host require_once works good. It shows up.
But when i upload the files to my sever the require_once does not show up on the register.php It just refreshes and i dont get the message "Please fill all required fields"
This is the code that works in local host but not in a live server <?php require_once 'messages.php'; ?>
Here is my full code
Register page: <html> <?php require_once 'messages.php'; ?> <br><br> <form action="register-clicked.php" method="POST"> Username:<br> <input type="text" name="usernamebox" placeholder="Enter Username Here"> <br><br> Email:<br> <input type="text" name="emailbox" placeholder="Enter email here"> <br><br> Password:<br> <input type="password" name="passwordbox" placeholder="Enter password here"> <br><br> Confirm Password:<br> <input type="password" name="passwordconfirmbox" placeholder="Re-enter password here"> <br><br> <input type="submit" name="submitbox" value="Press to submit"> <br><br> </form> </html>
Register clicked <?php
session_start();
$data = $_POST;
if( empty($data['usernamebox']) ||
empty($data['emailbox']) ||
empty($data['passwordbox']) ||
empty($data['passwordconfirmbox'])) {
$_SESSION['messages'][] = 'Please fill all required fields';
header('Location: register.php');
exit;
}
if ($data['passwordbox'] !== $data['passwordconfirmbox']) {
$_SESSION['messages'][] = 'Passwords do not match';
header('Location: register.php');
exit;
}
$dsn = 'mysql:dbname=mydatabase;host=localhost';
$dbUser='myuser';
$dbPassword= 'password';
try{
$connection = new PDO($dsn, $dbUser, $dbPassword);
} catch (PDOException $exception){
$_SESSION['messages'][] = 'Connection failed: ' . $exception->getMessage();
header('Location: register.php');
exit;
}
messages.php <?php
session_start();
if (empty($_SESSION['messages'])){
return;
}
$messages = $_SESSION['messages'];
unset($_SESSION['messages']);
?>
<ul>
<?php foreach ($messages as $message): ?>
<li><?php echo $message; ?></li>
<?php endforeach; ?>
</ul>
Edited Wednesday at 12:49 AM by bee65 Hi, I am not a PHP programmer. I took on a new client with a simple PHP site, without any databases. The site is up and running on the web. I would like to get it running on my local machine for further development. I have latest version of WAMP installed, running Apache version 2.2.11 and PHP version 5.3.0 I created a directory in the WAMP "www" project directory and it shows up there like it's supposed to when I browse to "localhost" Problem: The home page of website displays text but no, images, styles, footer, header, nav links, etc. Here is the code for the home page: <? define("NAV","home"); require_once('local/local.php'); ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>TITLE</title> <meta name="keywords" content=""> <meta name="Description" content=""> <? include("common/dochead.php"); ?> </head> <body onLoad="<? include('common/preloads.php'); ?>"> <!-- ============================ main ============================= --> <div id="main-frame"><div id="main" class="noCollapse"> <? include("common/sign.php"); ?> <div id="right-frame"> <? include("common/navigation.php"); ?> <div id="content-frame"> <div id="content"> <h1>Welcome</h1> <p>This is the content area. This is the content area. This is the content area. </p> </div><!-- end content --> </div><!-- end content-frame --> </div><!-- end right-frame --> <div class="clearFloats"></div> </div><!-- end main --></div><!-- end main-frame --> <? include("common/footer.php"); ?> </body> </html> Any help would be greatly appreciated. I have spent many hours on this. Regards Hi folks, I'm curious if I can for example, save a file from my server and it will save to all other servers - obviously if they accepted the connection first. It's for a software I developed and is almost complete and know there will be frequent updates to it. Instead of users downloading upates, I want the update files from my server to somehow synchronize to their server automatically? Anything called this?? Thanks for info. Following a tutorial on udemy, i tried to learn the very basics of mvc structure. I built the same project on my local server and it worked without giving me any error. but when i tried it on live server. its not working as it should. not showing any error. I tried to figure out the problem and found that for every page loading, it stops at the same line in my main.php file. <?php require($view); ?> starting from the above line. it stops. i came here to share my problem but i am unable to upload my files here. if there is a way to upload and share my files, please guide. zip file size of the whole project is 31.6 kb This isn't exactly an application design question, but rather a system design one.
I am about to install an Inventory Control System inside this store I work in.
The store itself also owns a Linode VPS running Centos 6.4 which hosts our website.
This new Inventory System will come built in with a Microsoft SQL Server, and supposedly it is a SQL Anywhere database, but I'm not too sure what that means.
I need to make this database publicly accessible, but only via the Linode VPS. Surely, setting restrictions is easy enough to address that issue. That isn't my question.
My first idea is to put this server into the DMZ, easy. But it doesn't exactly sound safe. So my next idea was to put a middleman server in the DMZ, this way the Linode can send queries to that middleman server and it will send that data to the SQL Server and back. This is very vaguely described I know, but I don't want to get too much into details, but rather, understand how I can create that middleman server, and what could Install onto it that would allow me to securely process queries?
My first thought was to install a webservice, that accepts an XML/JSON request and returns an XML/JSON response.
Then, I realized directly afterwards that I don't have any experience setting up a webservice like that.
What kind of options are there out there? Ultimately, my question is, should I just put the Server in the DMZ or should I create the middleman, and if so, can someone point me in the right direction as to getting a webservice set up? Edited by Zane, 15 July 2014 - 11:28 PM. Hey. I am wanting to move a couple of files from my current server to another. If i am uploading the file this is fine but if it is already on the server then im not sure how to move it. When uploading I can just use ftp_put($conn_id, $destination_file, $myFile, FTP_BINARY); What i need to do is figure out how to get a hold of the file and store it in $myFile then this would work fine. Is this possible? Cheers (This might be the wrong forum; it might be server-side configuration, but alas it is the code that *calls* fwrite, so I'll start here.) I have written a script, and one thing it does is generate a file to disk using fwrite. No big deal. Here's what interests me: On most servers, the file is written successfully when the folder's permissions are 755 with recursive permissions. On some servers, 755 fails. Only 777 works. How could this be? Are permissions=permissions=permissions? Why will 755 work on one machine but not another? I'm just a logic guy; I know very little of server-side configuration and/or why there would be a difference here. Just trying to learn. What I'm trying to do is copy all files from one server to another folder on another server. Here is what I have have so far.. <?PHP //connection settings $ftp_server = "server"; $ftp_user_name = "user"; $ftp_user_pass = "pass"; $dir = "/var/test/"; $destination_file = "/test/"; // set up basic connection $conn_id = ftp_connect($ftp_server); // login with username and password $login_result = ftp_login($conn_id, $ftp_user_name, $ftp_user_pass); // check connection if ((!$conn_id) || (!$login_result)) { echo "FTP connection has failed!"; echo "Attempted to connect to $ftp_server for user $ftp_user_name"; exit; } else { echo "Connected to $ftp_server, for user $ftp_user_name"; } if (ftp_chdir($conn_id, $dir)) { echo " <br/>Current directory is now: " . ftp_pwd($conn_id) . "\n<p/>"; } else { echo "Couldn't change directory\n<p/>"; } $buff = ftp_rawlist($conn_id, $dir); foreach($buff as $files) { echo $files. "<br/>"; if (ftp_get($conn_id, $destination_file."test.file", $dir."test.txt", FTP_BINARY)) { echo "<br/>Successfully written to $destination_file\n"; } else { echo "There was a problem\n"; } ?> That doesn't work. Any ideas? Thanks, Sean I just did a huge import from an app I have been working on. No issues except for this. I uploaded & imported all files & databases from my wampserver (localhost, local server) to my main online server. Before I continue with the problem, I have to give you info on how the files work. I am using a "controller" to view the files. Meaning, from index.php, I call all the files. For example, instead of mysite.com/register.php, its mysite.com/index.php?page=register. The index defines the doctype & html tags etc. The other files that are called through index.php are just pure php code, it does not contain the head & body tags etc. So, the issue is , when the surfer submits a form, i need to set a cookie. this cookie is VERY important. I cannot get it to work. I am getting the header warnings after submit Of course, this is to be expected. But I tried it on my local server, & it worked. I am not very familiar with cookies, this is a side of PHP i never really even touched. I know almost everything but that. So the php code is before the html code on the page, so I figured it was worth a shot. Im guessing the problem here is, since the code being outputted as index.php code + the form page code. So the cookie is being set after the html tags. How can I fix this? I need it to work thru the controller. I cannot just make it a single file, all files on the site needs to be thru this controller, otherwise it will mess everything up. Ino I could just add the code from index.php plus the form page code & just run the php code before all of the html tags, but like I said it has to be called thru index.php. I appreciate your replies, & I hope you guys dont think im an idiot & can understand my question, im terrible with words! I wish to create validation rules once which are used both on the client and on the server.
For instance, I will start off with the following PHP object:
stdClass Object
(
[rules] => stdClass Object
(
[email] => stdClass Object
(
[required] => 1
[email] => 1
[remote] => stdClass Object
(
[url] => check-email.php
[type] => post
[data] => stdClass Object
(
[username] => function() {return $( '#username' ).val();}
)
)
)
)
[messages] => stdClass Object
(
[email] => stdClass Object
(
[required] => an email is required
)
)
)
When the edit page is downloaded to the client, I will include this object in some format suitable to the client.
The client will then use the jQuery Validation plugin (http://jqueryvalidation.org/) along with the validation object, and client side validate the page.
When the form passes client side validation and is uploaded, PHP will use the same validation object to serverside validate the form (I have this part working as desired).
My question is how should I pass this data to the client? Originally, I would just use PHP to write some JavaScript.
exit('var myObj='.json_encode($myObj));
Note that when I json_encode the object, the value of $myObj->rules->email->remote->data->username is a string with quotes around it, however, I can easily use PHP to strip these tags before sending it to the client.
As Jacques1 pointed out in http://forums.phpfre...ascript-client/, I should never ever use PHP to generate JavaScript, and should use AJAX to download the JSON directly. I tried doing the later, but found that a callback function could not be included in the JSON.
Please advise on the best way to accomplish this.
Thank you
Hello, I want to ask you, how to code the next problem I want to transfer some coins from site A to site B, I have access to both sites. My question is, how can I update table on site B, when I send request for updating on site A. Basicly, I need to transfer value from site A, and site B should receive this value, and update table. How can I do it, what do I need? What would be the best way to return: One image (let's say, green.png) if the specified website is up Second image (let's say, red.png) if the specified website is down Third image (let's say, orange.png) if the website is slow. Would the best option be to use file_get_contents()? Or a exec() Hi I am on working on a communication system, on my computer I use xampp. On my computer I have created this one app, working with mysqli as well. On my system everything works perfectly...nothing goes wrong, all queries execute correctly. But when I upload this app...Its as the queries does not execute. When I use mysqli_fetch_array() function gives error and say that the first parameter is an boolean. The connection is correct and everything. Is there a chance that the fault is on the server's side and that it needs to be restarted? What can you recommend I should do? Thanks Hi, I would like to transfer some jpg image files from FTP server to my local server and I would like this to be done in a PHP script but I cannot figure out a way to do this without saving in my local harddrive. If anyone have any ideas and share this with us that would be very much appreciated!!! Thank you. Kind regards, Jae |
|||||||