PHP – Securing your Web Application : File Access

If only you and people you trust can log in to your web server, you don’t need to worry about file permissions for files used by or created by your PHP programs. However, most websites are hosted on ISP’s machines, and there’s a risk that non trusted people can read files that your PHP program creates. There are a number of techniques that you can use to deal with file permissions issues.

Restrict Filesystem Access to a Specific Directory You can set the open_basedir option to restrict access from your PHP scripts to a specific directory. If open_basedir is set in your php.ini, PHP limits filesystem and I/O functions so that they can operate only within that directory or any of its subdirectories. For example:

open_basedir = /some/path

With this configuration in effect, the following function calls succeed:

unlink("/some/path/unwanted.exe");

include("/some/path/less/travelled.inc");

But these generate runtime errors:

$fp = fopen("/some/other/file.exe", 'r');

$dp = opendir("/some/path/../other/file.exe");

Of course, one web server can run many applications, and each application typically stores files in its own directory. You can configure open_basedir on a per-virtual host basis in your httpd.conf file like this:

<VirtualHost 1.2.3.4>
ServerName domainA.com
DocumentRoot /web/sites/domainA
php_admin_value open_basedir /web/sites/domainA
</VirtualHost>

Similarly, you can configure it per directory or per URL in httpd.conf:

# by directory

<Directory /home/httpd/html/app1>
php_admin_value open_basedir /home/httpd/html/app1
</Directory>

# by URL

<Location /app2>
php_admin_value open_basedir /home/httpd/html/app2
</Location>

The open_basedir directory can be set only in the httpd.conf file, not in .htaccess files, and you must use php_admin_value to set it.

Get It Right the First Time

Do not create a file and then change its permissions. This creates a race condition, where a lucky user can open the file once it’s created but before it’s locked down. Instead, use the umask() function to strip off unnecessary permissions. For example:

umask(077); // disable ---rwxrwx

$fh = fopen("/tmp/myfile", 'w');

By default, the fopen() function attempts to create a file with permission 0666 (rw-rwrw-). Calling umask() first disables the group and other bits, leaving only 0600 (rw-------). Now, when fopen() is called, the file is created with those permissions.

Don’t Use Files

Because all scripts running on a machine run as the same user, a file that one script creates can be read by another, regardless of which user wrote the script. All a script needs to know to read a file is the name of that file.

There is no way to change this, so the best solution is to not use files to store data that should be protected; the most secure place to store data is in a database.

A complex workaround is to run a separate Apache daemon for each user. If you add a reverse proxy such as haproxy in front of the pool of Apache instances, you may be able to serve 100+ users on a single machine. Few sites do this, however, because the complexity and cost are much greater than those for the typical situation, where one Apache daemon can serve web pages for thousands of users.

Session Files

With PHP’s built-in session support, session information is stored in files. Each file is named /tmp/sess_id, where id is the name of the session and is owned by the web server user ID, usually nobody.

Because all PHP scripts run as the same user through the web server, this means that any PHP script hosted on a server can read any session files for any other PHP site. In situations where your PHP code is stored on an ISP’s server that is shared with other users’ PHP scripts, variables you store in your sessions are visible to other PHP scripts.

Even worse, other users on the server can create files in the session directory /tmp. There’s nothing preventing a user from creating a fake session file that has any variables and values he wants in it. The user can then have the browser send your script a cookie containing the name of the faked session, and your script will happily load the variables stored in the fake session file.

One workaround is to ask your service provider to configure their server to place your session files in your own directory. Typically, this means that your VirtualHost block in the Apache httpd.conf file will contain:

php_value session.save_path /some/path

If you have .htaccess capabilities on your server and Apache is configured to let you override options, you can make the change yourself.

Concealing PHP Libraries

Many a hacker has learned of weaknesses by downloading include files or data that are stored alongside HTML and PHP files in the web server’s document root. To prevent this from happening to you, all you need to do is store code libraries and data outside the server’s document root.

For example, if the document root is /home/httpd/html, everything below that directory can be downloaded through a URL. It is a simple matter to put your library code, configuration files, logfiles, and other data outside that directory (e.g., in /usr/local/lib/myapp). This doesn’t prevent other users on the web server from accessing those files but it does prevent the files from being downloaded by remote users.

If you must store these auxiliary files in your document root, you should configure the web server to deny requests for those files. For example, this tells Apache to deny requests for any file with the .inc extension, a common extension for PHP include files:

<Files ~ "\.inc$">
Order allow,deny
Deny from all
</Files>

A better and more preferred way to prevent downloading of PHP source files is to always use the .php extension.

If you store code libraries in a different directory from the PHP pages that use them, you’ll need to tell PHP where the libraries are. Either give a path to the code in each include() or require(), or change include_path in php.ini:

include_path = ".:/usr/local/php:/usr/local/lib/myapp";

Here is the list of of Article in this Series:

Please share the article if you like let your friends learn PHP Security. Please comment any suggestion or queries.

 

Thanks Kevin Tatroe, Peter MacIntyre and Rasmus Lerdorf. Special Thanks to O’Relly.

WordPress – Add Retina Image Support to Your Theme

Today, with increasing of high resolution devices, Client ask developer to add retina image support to their theme. Support Retina is to display high quality image on high resolution devices. This means we need to create high resolution images and to load right images based on screen resolutions.

There are some plugins available on WordPress for regular users to add retina display images. Searching a wordpress directory for plugin shows below 5 plugins on top

Each plugin show use different way to show retina images but internal all  includes two things, A detection script and a retina-ready image creation function. For developer who want to include the feature of displaying retina image to their theme, It very first step to select right JavaScript to detect the screen resolution and display the image.

Detect Screen Display

We need to display high quality image if user device is supporting it. The best way to detect a screen is using JavaScript.  I generally use a script called retina.js by Imulus. Its size is only 4kb and includes all the front-end functionality you need to detect a retina display and load the right image.

Copy retina.js file to your theme /js folder. It should be in right place to enqueue the script correctly.

Add following code to your functions.php file

add_action( 'wp_enqueue_scripts', 'retina_support_enqueue_scripts' );
/**
 * Enqueueing retina.js
 *
 * This function is attached to the 'wp_enqueue_scripts' action hook.
 */
function retina_support_enqueue_scripts() {
    wp_enqueue_script( 'retina_js', get_template_directory_uri() . '/js/retina.js', '', '', true );
}

Above code is enough to detect the screen display. Now we have to create function to create high quality image.

High Quality Image Creation

We need to add a function such that each time image is uploaded or added a high resolution image is created automatically and stored with @2x added to the filename. The detection JavaScript will search for @2x suffix in filename to load the retina-ready version of the image if required.

In order to make sure that a retina-ready image is created automatically whenever an image is uploaded, you need to hook into the appropriate WordPress filter. The correct one to use is wp_generate_attachment_metadata.

Add the following code in functions.php of your theme

add_filter( 'wp_generate_attachment_metadata', 'retina_support_attachment_meta', 10, 2 );
/**
 * Retina images
 *
 * This function is attached to the 'wp_generate_attachment_metadata' filter hook.
 */
function retina_support_attachment_meta( $metadata, $attachment_id ) {
    foreach ( $metadata as $key => $value ) {
        if ( is_array( $value ) ) {
            foreach ( $value as $image => $attr ) {
                if ( is_array( $attr ) )
                    retina_support_create_images( get_attached_file( $attachment_id ), $attr['width'], $attr['height'], true );
            }
        }
    }

    return $metadata;
}

The above function checks to see if the uploaded file is an image. If it is, then it processes it using the retina_support_create_images() function.

Create An Image

Now as we checked if image is added and its time to create high quality image.

This code will also be placed in functions.php

/**
 * Create retina-ready images
 *
 * Referenced via retina_support_attachment_meta().
 */
function retina_support_create_images( $file, $width, $height, $crop = false ) {
    if ( $width || $height ) {
        $resized_file = wp_get_image_editor( $file );
        if ( ! is_wp_error( $resized_file ) ) {
            $filename = $resized_file->generate_filename( $width . 'x' . $height . '@2x' );

            $resized_file->resize( $width * 2, $height * 2, $crop );
            $resized_file->save( $filename );

            $info = $resized_file->get_size();

            return array(
                'file' => wp_basename( $filename ),
                'width' => $info['width'],
                'height' => $info['height'],
            );
        }
    }
    return false;
}

By this function, new retina image will be created  with suffix @2x added to the name. Now detection script will work with these new image.

That’s all you need to do to make it work, but adding one extra function will help in reducing the usage of server bytes. This function is for deleting the image that we have created for retina display when original image is deleted.

Delete the Image

If is a good to delete the retina-image if original image is deleted.

Add following code to functions.php of your theme

add_filter( 'delete_attachment', 'delete_retina_support_images' );
/**
 * Delete retina-ready images
 *
 * This function is attached to the 'delete_attachment' filter hook.
 */
function delete_retina_support_images( $attachment_id ) {
    $meta = wp_get_attachment_metadata( $attachment_id );
    $upload_dir = wp_upload_dir();
    $path = pathinfo( $meta['file'] );
    foreach ( $meta as $key => $value ) {
        if ( 'sizes' === $key ) {
            foreach ( $value as $sizes => $size ) {
                $original_filename = $upload_dir['basedir'] . '/' . $path['dirname'] . '/' . $size['file'];
                $retina_filename = substr_replace( $original_filename, '@2x.', strrpos( $original_filename, '.' ), strlen( '.' ) );
                if ( file_exists( $retina_filename ) )
                    unlink( $retina_filename );
            }
        }
    }
}

In this tutorial we learn how to add support of displaying retina image in WordPress theme. This will help theme developer in adding retina support to their theme.

 

Thanks to wptuts+.

Faceted Search (Layered Search) on MySQL database with example.

Last few day I was searching for the layered search using MySQL. Layered Search is actually a Faceted Search. (Magento, a highly professional e-commerce platform on php name it Layered Search). Faceted Search can be done using two way MySQL/Any DB Application or using Apache Solr.

In this post I will show you how we can do Faceted search using MySQL database. You need a specific database schema, but it’s feasible. Here’s a simple example:

product Table

+----+------------+
| id | name       |
+----+------------+
|  1 | blue paint |
|  2 | red paint  |
+----+------------+

classification Table

+----+----------+
| id | name     |
+----+----------+
|  1 | color    |
|  2 | material |
|  3 | dept     |
+----+----------+

product_classification Table

+------------+-------------------+-------+
| product_id | classification_id | value |
+------------+-------------------+-------+
|          1 |                 1 | blue  |
|          1 |                 2 | latex |
|          1 |                 3 | paint |
|          1 |                 3 | home  |
|          2 |                 1 | red   |
|          2 |                 2 | latex |
|          2 |                 3 | paint |
|          2 |                 3 | home  |
+------------+-------------------+-------+

So, say someones search for paint, you’d do something like:

SELECT p.* FROM product p WHERE name LIKE '%paint%';

This would return both entries from the product table.

Once your search has executed, you can fetch the associated facets (filters) of your result using a query like this one:

SELECT c.id, c.name, pc.value FROM product p
   LEFT JOIN product_classification pc ON pc.product_id = p.id
   LEFT JOIN classification c ON c.id = pc.classification_id
WHERE p.name LIKE '%paint%'
GROUP BY c.id, pc.value
ORDER BY c.id;

This’ll give you something like:

+------+----------+-------+
| id   | name     | value |
+------+----------+-------+
|    1 | color    | blue  |
|    1 | color    | red   |
|    2 | material | latex |
|    3 | dept     | home  |
|    3 | dept     | paint |
+------+----------+-------+

So, in your result set, you know that there are products whose color are blue and red, that the only material it’s made from is latex, and that it can be found in departments home and paint.

Once a user select a facet, just modify the original search query:

SELECT p.* FROM product p
   LEFT JOIN product_classification pc ON pc.product_id = p.id
WHERE 
   p.name LIKE '%paint%' AND (
      (pc.classification_id = 1 AND pc.value = 'blue') OR
      (pc.classification_id = 3 AND pc.value = 'home')
   )
GROUP BY p.id
HAVING COUNT(p.id) = 2;

So, here the user is searching for keyword paint, and includes two facets: facet blue for color, andhome for department. This’ll give you:

+----+------------+
| id | name       |
+----+------------+
|  1 | blue paint |
+----+------------+

So, in conclusion. Although it’s available out-of-the-box in Solr, it’s possible to implement it in SQL fairly easily.

 

Thanks stackoverflow.com

Install Apache Solr on Windows with Wamp

Apache Solr is useful for Searching, Indexing, Faceted Search, Dynamic clustering. You can see full feature of Apache Solr Here. It is based on Apache Lucene Search Library and extends it. Here I will show you how to install Apache Solr on Windows and integrating it with WAMP Server. (Integration with WAMP is not mandatory if you are not using it)

The easiest way to install Apache Solr on Windows is to use Solr installer from BitNami. This can be found here http://bitnami.com/stack/solr. Download the installer and run it with administrative rights. Try to keep the installation path simple something like “c:/solr/” will be appropriate.

It will also install an Apache Server so if you don’t have WAMP or Apache already installed than its super easy, just go with the flow. If you already have WAMP installed than make this Apache listen on some available port  other than 80 (where WAMP ‘s Apache is listening).

Once the setup is complete Solr will be available for use in port selected during setup (see no big deal). Now if you have WAMP and you don’t want to have two Apache services running do the following steps.

  • Enable proxy_module and proxy_http_module via WAMP menu or directly from Apache conf file.
  • Open httpd.conf file and add following line at the end of the file
    Include "c:/solr/apache-solr/conf/solr.conf"

    Note that the path here should be correctly pointing to the solr.conf file. Use the path where you installed the Solr.

  • Now restart the WAMP Apache via WAMP menu. If it starts correctly than its cool, otherwise check if you have correctly enabled the said modules, and path to solr config file.
  • Now check http://localhost/solr/ this should show the dashboard for solr.
  • Remember the extra Apache service we need to disable it so it does not start automatically as we don’t need it. So goto Control Panel > Administrative Tools > Services , double click “solrApache” service and change its “Startup Type” to “Manual”. Now it will not start once your system is restarted.

 

 

Thanks to sphinxconsultant.com

Opencart – Category Carousel of Product

Category Product Carousel – Opencart is new Opencart extension module by TheDigiLife. Category Product Carousel – Opencart is very useful in displaying products of particular category in carousel. This Opencart module is easy to use as it looks like core Opencart module. This module not update any core files.

Category Product Carousel – Opencart supports multilanguage. You can visit this plugin on Opencart marketplace here. This module uses jQuery Carousel which comes bundled with Opencart installation so no extra file is added.

Category Product Carousel – Opencart is light weight module. Installation instruction are as follow.

  1. Download the zip file, extract somewhere on your computer. 
  2. From extracted file, upload the the files/folder under “upload” folder to server using FTP, in root folder (where admin,catalog,system folder are available) of Opencart installation 
  3. Go to admin area of you Opencart website and Click on Extension > Modules
  4. Install Category Product Carousel
  5. Edit Category Product Carousel
  6. At last add module on you desired page.

Below are the screenshots

admin-area-configuration

category-carousel-example

logoimage

You can download Category Product Carousel – Opencart Here

Opencart – Shopping cart in Pop Up and Buy Now Button

Recently we released new Opencart plugin named “Product Buy Now button and Cart in Popup – Opencart – VQMOD“. This is useful extension of Opencart for replacing the “Add to cart” button with “Buy Now” button. Clicking on Buy Now button opens shopping cart in popup. Popup shopping cart is fully functioned. User can change quantity, remove any product, Apply coupon code, etc. in popup itself.

Product Buy Now button and Cart in Popup – Opencart – VQMOD extension of Opencart makes your site User friendly and easy access to shopping cart. Shopping cart popup is displayed using Colorbox jQuery plugin popup. Colorbox jQuery comes bundled with Opencart installation so no extra file include.

This Opencart plugin is developed using vQmod so no core files will be changed. Installation is very easy.

This Opencart extension support multilanguage.

Here is the screenshot of extension.

You can download the plugin Here

OpenCart – Options Mouse Hover ToolTip Help

Recently new Opencart extension launched on Opencart market place. It is Options Mouse Hover ToolTip Help. Plugin is really cool and useful in showing ToopTip Text for product option in Opencart.

Opencart is E- Commerce / Shopping Cart  Open Source solution. Its stands on second place when comparing to similar solution like Magento, PrestShop etc.  OpenCart is really useful for medium businesses. It is a feature rich open source shopping cart solution.

Opencart is missing feature to add help text for Available Options for products. This plugin help administrator to add text from admin and show it to Customer for more information on Options.

This plugin can also be useful in showing some options Notes, disclaimer or simple information. Extension interface is really easy.

Also it supports “vqmod” so that no core file will be updated. You can find more information on vqmod here.

Visit the extension page on opencart market place. Click Here

Here are some screenshot of plugins.

Admin Multiple Value Tooltip

Admin Single Value Tooltip

Customer / Front end View

 

Build Custom Kernel in UBUNTU (With disabled USB and Bluetooth)

Today Lets make our own OS/Kernel, which doesn’t support USB and BLUETOOTH. After reading this article, you are able to make any kind of your kernel, like disabled graphics disabled Soundcard; you can also disable your CD-ROM, WLAN, MULTIMEDIA. In short you can make your own OS/Kernel as per your requirement. 

Here, we are going to make a kernel, which doesn’t support USB, Bluetooth. This kind of OS is mostly used in Cyber Cafe, Education Department, School or offices, at which security of data is very important. So let’s concentrate on our pretty interesting task: (yes, every tough task could be make easy by just make it interesting)

Ok, let’s start our process:

Step 1: Get Latest Linux kernel code 

Visit http://kernel.org/ and download the latest source code. File name would be Linux- x.y.z.tar.bz2, where x.y.z is actual version number. For example file linux-3.5.3.tar.bz2 represents 3.5.3kernel version. Download it on your desktop path now; you have kernel linux-3.5.3.tar.bz2 on your desktop

[Create a folder on desktop with a name (avoid space in name). suppose we make folder “jimit” (without quotes), copy your linux-3.5.3.tar.bz2 file in this folder]

Step 2: Open Terminal and direct your path

Open terminal (CTRL+ALT+T) and type a path of that folder in which you copied your kernel

After reaching to your folder, here it is “jimit”, you can check your kernel by just type a command: ls (it’s not required)

[NOTE: during whole process, you need not require to write $ or # symbol, you have to just type commands]

Step 3: Extract your kernel

Now, this kernel file is like a rar file, you have to extract this file for that type this command

$ tar -xjvf  linux -x -x -x.tar.bz2

[ Here, Linux -x-x-x means type your kernel version like Linux -3.5.3.tar.bz2,after typing this  command ,this file will be extracted on same folder.]

Now, after extracting this folder, go in to that extracted folder and type:

$ cd linux 3.5.3

Step 4:  Kernel Configuration

Now type:

$ make menuconfig

[if its not work,then you have to install ncurses library,for that just type:]

sudo apt-get install ncurses-dev

As you type this command, after little process one blue window will open

Here, for disable USB support, go on to device drivers and then in Submit space up to   when   * or M symbol is removed. For disable this supports, there must be a null before it.
[For back window, hit Esc key for two times]
same for Bluetooth just go in network support, and then in Bluetooth.hit space and disable it but giving it null. Now for save and exit, hit Esc key two times, and give yes for save & quit.
After extracting and support changes, type one another command

$ make

Type this command and sleep for 3 hours (dual core processor people),i3,i5 processor  people can sleep just for 1-2 hours. yes, if you have dual core processor or any old processor ,this process will take 3 hours, else it will take 1-2 hours.

Now wake up, process is almost done.

Step 5: Buildup Module

Now, type another command

$ make modules

Step 6: Become Root user

After all this commands, you have to become a root user, means you have an authority for doing any changes by commands, for that type this commands

$ sudo su

 

As you type this, system will ask you for password, give it, and you can see $ symbol is replaced by # symbol, it means you are a root user, then type another command,

# make modules_install

And then type last one

# make install
# cd /boot
# mkinitrd -o initrd.img-3.5.3  3.5.3 (or use mkinitramfs)
# update-grub

It’s done. Now just type

# reboot.

And system will restart. As you can see at the starting of system, you have an option of kernel, select your kernel (for here it is 3.5.3) and access it, in which you are not able to access your USB and BLUETOOTH.

Share and Comment if you like the post or Have any query.

Thanks, Good Day

Lock your Private Folder in Ubuntu

Hello everybody, Today we are going to learn that, how to lock our private folder, file in Ubntu in just few mins. It’s mainly used when we need to secure our important data from others.

Here,we just remove the permission read(r) ,write(w) and execute(x) of file, then it will automatically be locked, and for that we just need to write a few commands.

Before that lets make a folder xyz on desktop. We are going to lock this folder “xyz”. 

Step 1: Open terminal (CTRL+ALT+T)

Then go to on your folder path,here,our folder is on desktop.
Then type:

Step 2: cd Desktop

then type:

step 3: ls -l

Now,here you can see folder name “XYZ”,2nd line from bottom. [here,GREEN BOX]
Exactly in that first row, you can see like this
drwxrwxrwx ( it shows the permission of xyz file)
where,
d = directory
r =read
w=write
x= execute.
Now, we want to lock this xyz file, means remove permission of read, write and execute
then just type:

step 4:  chmod 000 xyz

DONE..
now go to that file, and try to open that file..

this is our file location,on which you can see like cross symbol,which indicates that you dont have permission to open this file. if you are trying to open this file, you will get error like this.

now to UNLOCK this folder,
type in terminal

step 5: chmod 777 xyz

after giving this command, you can see on folder that,cross symbol is magically removed, that means now you are able to access this folder.

So,in short,by this way you can lock any folders,files.

Overview of commands: 

  1. CTRL+ALT+T
  2. cd Desktop ( what ever your file location)
  3. ls -l
  4. chmod 000 xyz ( it will lock the file.)
  5. chmod 777 xyz (it will unlock the file)