Go Back    Forum > Digital Publishing / Web Sites > Website and Server Troubleshooting

Reply
 
LinkBack Thread Tools
  #1  
09-20-2012, 11:19 PM
kpmedia's Avatar
kpmedia kpmedia is offline
Site Staff | Web Hosting, Photo
 
Join Date: Feb 2004
Posts: 4,311
Thanked 374 Times in 341 Posts
Anybody have an idea on how this WordPress include page function could be sanitized to only work with pulling content from a single domain?

PHP Code:
function show_file_func$atts ) {
  
extractshortcode_atts( array(
    
'file' => ''
  
), $atts ) );
 
  if (
$file!='')
    return @
file_get_contents($file);
}
add_shortcode'show_file''show_file_func' ); 
The above function adds this shortcode:
PHP Code:
[show_file file="http://www.somesite.com/somepage.html"
... which then includes that entire page inside the WordPress page/post.

I see this as a potential exploit, unless you're able to sanitize it against a single (or multiple) chosen safe domains. I'm only interested in a single valid domain -- at least at the moment. I'm trying to dev a site right now, and this part is eluding me. It's going to pull static pages from a CDN (cdn.somesite.com), if I can get it working.

- Did my advice help you? Then become a Premium Member and support this site.
- Please Like Us on Facebook | Follow Us on Twitter

- Need a good web host? Ask me for help! Get the shared, VPS, semi-dedicated, cloud, or reseller you need.
Reply With Quote
Someday, 12:01 PM
admin's Avatar
Ads / Sponsors
 
Join Date: ∞
Posts: 42
Thanks: ∞
Thanked 42 Times in 42 Posts
  #2  
09-21-2012, 12:15 AM
kpmedia's Avatar
kpmedia kpmedia is offline
Site Staff | Web Hosting, Photo
 
Join Date: Feb 2004
Posts: 4,311
Thanked 374 Times in 341 Posts
I solved it.

This is the function:
PHP Code:
function show_file_func$atts ) {
$url 'http://somesite.com/';
  
extractshortcode_atts( array('file' => ''), $atts ) );
  if (
$file!='')
    return @
file_get_contents($url.$file);
}
add_shortcode'show_file''show_file_func' ); 
And the new shortcode is now:
PHP Code:
[show_file file="somepage.html"

- Did my advice help you? Then become a Premium Member and support this site.
- Please Like Us on Facebook | Follow Us on Twitter

- Need a good web host? Ask me for help! Get the shared, VPS, semi-dedicated, cloud, or reseller you need.
Reply With Quote
Reply




Similar Threads
Thread Thread Starter Forum Replies Last Post
ATI All in Wonder 2006 PCIE: TV function does not work kennyb Capture, Record, Transfer 4 05-02-2012 07:02 AM
ATI MMC "Video Snapshot" function doesn't snap! rocko Capture, Record, Transfer 1 04-05-2012 04:35 AM
Verbatim is single speed (16x). I want 8x burning RobCr Blank Media 4 09-04-2010 04:36 AM
Procoder 2.0 to shrink 6GB video to single layer DVD ? MBates05 Encode, Convert for discs 19 12-19-2005 04:45 AM

Thread Tools



 
All times are GMT -5. The time now is 01:10 PM