Security test for writing to remote directory
Short question: how can I test whether or not a directory in my website is in practice writable for the rest of the world (even outside my own machine)?
Context:
I run this website where the hosting provider has implement开发者_如何学Ced an odd security system. To let PHP write files to disk on the (linux) server, the target dir should have write permissions for everyone.
To me this would seem like a gaping security hole (note there are no users uploading stuff, only my PHP script generating files), but my host told me its safe, as they've got other (unspecified) security measures in place to keep the world from accessing my target directory. I am skeptical, so I want to make sure all is safe.
So, I know my directory permissions -- I have set them and tested them. I know my script can write to that directory. Now I want to make sure I really am the only one who can write to that dir, despite having given everyone file permissions to do so.
For example: is there a PHP function to write to a remote directory, like fopen('http://domain.tld/foo/evil-hack.php', 'w')
? I have tested that and it doesn't work, but that doesn't prove to me that somebody else won't find another way.
The php function CHMOD is your answer:
http://php.net/manual/en/function.chmod.php
addition and fileperms();
should help you too.
精彩评论