http://phpsec.org/projects/phpsecinfo/t … fopen.html
PHP Security Consortium wrote:
If enabled, allow_url_fopen allows PHP's file functions -- such as file_get_contents() and the include and require statements -- can retrieve data from remote locations, like an FTP or web site. Programmers frequently forget this and don't do proper input filtering when passing user-provided data to these functions, opening them up to code injection vulnerabilities. A large number of code injection vulnerabilities reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering.
allow_url_fopen is on by default.
Recommendations
You should disable allow_url_fopen in the php.ini file
If enabled, allow_url_fopen allows PHP's file functions -- such as file_get_contents() and the include and require statements -- can retrieve data from remote locations, like an FTP or web site. Programmers frequently forget this and don't do proper input filtering when passing user-provided data to these functions, opening them up to code injection vulnerabilities. A large number of code injection vulnerabilities reported in PHP-based web applications are caused by the combination of enabling allow_url_fopen and bad input filtering.
allow_url_fopen is on by default.
Recommendations
You should disable allow_url_fopen in the php.ini file
I checked with my host and with a server configuration expert and they too strongly advise to keep allow_url_fopen disabled.
It strikes me as odd that I need to enable a function to retrieve data from remote locations, while I only need data from my server. I do not need a feed from anywhere else.
I read here that there are alternative ways to handle this:
http://tutorials.ausweb.com.au/web/Tuto … url_fopen/
AUSWEB Hosting wrote:
Security issues - allow_url_fopen
The PHP option allow_url_fopen would normally allow a programmer to open, include or otherwise use a remote file using a URL rather than a local file path. For security reasons, AUSWEB has disabled this feature; however, a feature-rich alternative exists in the form of the bundled cURL library
Server-Side Includes
Many developers include files by pointing to a remote URL, even if the file is within the local system. For example:
<?php include("http://example.com/includes/example_include.php"); ?>
With allow_url_fopen disabled, this method will not work. Instead, the file must be included with a local path, and there are three methods of doing this:
1. By using a relative path, such as ../includes/example_include.php.
2. By using an absolute path (also known as relative-from-root), such as /home/username/example.com/includes/example_include.php.
3. By using the PHP environment variable $_SERVER['DOCUMENT_ROOT'], which returns the absolute path to the web root directory. This is by far the best (and most portable) solution. The example that follows shows the environment variable in action:
Processing Differences (and passing variables to an included file)
It is worth mentioning that the alternative solutions presented here will result in a difference in the way the include() function is handled. The alternative solutions all return the PHP code from the included page; however, the now-unavailable remote URL method returns the result from the included page. One result of this behavior is that you cannot pass a querystring using the alternative solutions. You define the variables locally before performing the include:
Example
To achieve the effect of this:
<?php include("http://yourdomain.com/includes/example_include.php?var=example"); ?>
You must instead use this:
<?php
$var = "example";
include($_SERVER['DOCUMENT_ROOT']."/includes/example_include.php");
?>
Example exploitation
If allow_url_fopen is enabled, this system can be exploited by simply changing the value of the variable in the querystring:
http://yourdomain.com/index.php?page=ht … script.txt
So to avoid potential compromisse of our clients websites the PHP variable allow_url_fopen=off is on all our servers now
Security issues - allow_url_fopen
The PHP option allow_url_fopen would normally allow a programmer to open, include or otherwise use a remote file using a URL rather than a local file path. For security reasons, AUSWEB has disabled this feature; however, a feature-rich alternative exists in the form of the bundled cURL library
Server-Side Includes
Many developers include files by pointing to a remote URL, even if the file is within the local system. For example:
<?php include("http://example.com/includes/example_include.php"); ?>
With allow_url_fopen disabled, this method will not work. Instead, the file must be included with a local path, and there are three methods of doing this:
1. By using a relative path, such as ../includes/example_include.php.
2. By using an absolute path (also known as relative-from-root), such as /home/username/example.com/includes/example_include.php.
3. By using the PHP environment variable $_SERVER['DOCUMENT_ROOT'], which returns the absolute path to the web root directory. This is by far the best (and most portable) solution. The example that follows shows the environment variable in action:
Processing Differences (and passing variables to an included file)
It is worth mentioning that the alternative solutions presented here will result in a difference in the way the include() function is handled. The alternative solutions all return the PHP code from the included page; however, the now-unavailable remote URL method returns the result from the included page. One result of this behavior is that you cannot pass a querystring using the alternative solutions. You define the variables locally before performing the include:
Example
To achieve the effect of this:
<?php include("http://yourdomain.com/includes/example_include.php?var=example"); ?>
You must instead use this:
<?php
$var = "example";
include($_SERVER['DOCUMENT_ROOT']."/includes/example_include.php");
?>
Example exploitation
If allow_url_fopen is enabled, this system can be exploited by simply changing the value of the variable in the querystring:
http://yourdomain.com/index.php?page=ht … script.txt
So to avoid potential compromisse of our clients websites the PHP variable allow_url_fopen=off is on all our servers now
I am not willing to take this major security risk.
Can you please instruct me how to edit the files, to make the ticker work without allow_url_fopen?
(I did already open up a support ticket, but they said it should be answered here.
