Preventing Remote File Inclusion code

Preventing Remote File Inclusion

[Afterlithe]

Hi guys, thought I would create a new post for this, even though the same code was recommended to me in another thread.

The code works great and it is easy to use. I only run into one problem when using it though. Here is the code in the template page:

<?php
$page = $_GET['page'];
switch ($page) {
case "press-release-archive.php":
include "press-release-archive.php";
break;
case "press-release-archive-detail.php":
include "press-release-archive-detail.php";
break;
default:
echo "You have requested an invalid page.";
break;
}
?>

It includes and displays the archive page just fine (which is just a list of databse articles). When you click on one of the articles, it goes to the detail page, which displays the correct db listing by id.

My problem is that I get the "You have requested an invalid page." error, when I click on the link to display the info. But it displays the correct URL in the address bar. I know it might be pretty easy to fix, but I sluggin through PHP the best I can at the moment =)

[dreamcatcher]

Hi Afterlithe,

Are you sure that the $page var contains one of your case statements? No lower/upper case differences?

example.com/index.php?page=press-release-archive.php

dc

[le_gber]

Afterlithe,

how do you pass on the variable to tell them which article to display?

is it something like:
press-release-archive-detail.php?id=1
press-release-archive-detail.php?id=2

It may be that when you request the GET this is what you 'get' back

[Afterlithe]

This how the link works:

<a href="?page=press-release-archive-detail.php?id=<?php echo $row_list['id'];?>"><?php echo $row_list['title'];?></a>

So the URL will be:
?page=press-release-archive-detail.php?id=293
?page=press-release-archive-detail.php?id=1
?page=press-release-archive-detail.php?id=2
etc..... depending on the id.

The archive page displays perfectly. I only get the "Invalid page..." error on the bottom of the Case statements when I click on the link and open up the detail page.

[edited by: Afterlithe at 5:44 pm (utc) on April 5, 2007]

[le_gber]

That's because I think you get 'press-release-archive-detail.php?id=2' with your GET requests, and your switch checks only for 'press-release-archive-detail.php'.

I assume that you don't have an id after the 'press-release-archive.php'

[Afterlithe]

The switch staement checks for both the archive and the detail page. I put?id= at the end of the archive and detail page with no luck. I will try and see if I can find any more ideas.

[edited by: Afterlithe at 9:10 pm (utc) on April 5, 2007]

[eelixduppy]

Afterlithe, try something like this:

$page = (isset($_GET['page']))?$_GET['page']:NULL;
switch($page) {
  case 'press-release-archive.php':
   include("press-release-archive.php");
   break;
  case 'press-release-archive-detail.php':
   include("press-release-archive-detail.php");
   break;
  default:
   echo "You have requested an invalid page.";
   break; 
}

Where the URI is something like this:

http://www.example.com/?page=press-release-archive.php[b]&id=293[/b]

Notice the use of the ampersand and not the question mark before the ID

[Afterlithe]

Thanks for the help, but its still not working. I used the above exaple and put something like

?page=press-release-archive-detail.php?id=<?php echo $row_list['id'];?>

In place of the link, and still didn't work. Weird that you would go to the correct page, but "Invalid Page...." would be displayed in the place of the detail info.

[eelixduppy]

Remember to use the ampersand like this:

?page=press-release-archive-detail.php[3]&[/3]id=<?php echo $row_list['id'];?>

Otherwise it is going to mess up the string.

[Afterlithe]

Ok, now I get this error when using:

case "press-release-archive-detail.php&id=<?php echo $row_list['id'];?> ":
include "press-release-archive-detail.php&id=<?php echo $row_list['id'];?>";
break;

Parse error: parse error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING

[eelixduppy]

These should be changed to this:

case "press-release-archive-detail.php&id={$row_list['id']}":
include "press-release-archive-detail.php&id={$row_list['id']}"; 

I don't know how I didn't see this before, but you already have this code within PHP tags and the code is being executed as such; there is no need to open new ones to place the variable within the string.

[Afterlithe]

Thanks for the quick reply. I still get the "invalid page".

This script is in the template, and not in any of the pages the template calls like index.php?page=press-release-archive.php. Would having the code in the template be causing this issue?

I don't know much about php at the moment, so this is really frustrating me. I have a nice little classroom on a cd thing that I will start learning php with shortly.

Thanks for bearing with me.

[edited by: Afterlithe at 9:57 pm (utc) on April 5, 2007]