Git Product home page Git Product logo

merciful-polluter's Introduction

MercifulPolluter

To relieve register_globals and magic_quotes_gpc refugees.

Build Status Coverage Status Scrutinizer Code Quality

Description

In PHP 5.4, violent directives (register_globals and magic_quotes_gpc) has been removed. But there are systems that may still depend on them.

This library reproduce these features in PHP 5.4 and later. Salvation

Usage

<?php
/**
 * example.com/?foo=3&bar=12
 */

(new Gongo\MercifulPolluter\Request)->pollute();

global $foo, $bar;
var_dump($foo, $bar);

/**
 * int(3)
 * int(12)
 */

Installation

Add this lines to your application's composer.json:

{
    "require": {
        "gongo/merciful-polluter": "*"
    }
}

And then execute:

$ composer install

Or install it yourself as:

$ composer require gongo/merciful-polluter

See also: https://packagist.org/packages/gongo/merciful-polluter

Features

Emulate register_globals

Add this lines to your application's entry point (like in auto_prepend_file):

<?php
$request = new Gongo\MercifulPolluter\Request;
$request->pollute();

// main routine...

If use the session, call Gongo\MercifulPolluter\Session::pollute() after session_start():

session_start();

/**
 * $_SESSION['user_id'] = 'gongo'
 */

(new Gongo\MercifulPolluter\Session)->pollute();

var_dump($user_id); // string(5) "gongo"

// Reference global variables to session.
$user_id = 'taro';
var_dump($_SESSION['user_id']); // string(4) "taro"

Emulate magic_quotes_gpc

If want to apply magic_quotes_gpc, call Gongo\MercifulPolluter\Request::enableMagicQuotesGpc():

<?php
/**
 * example.com/?foo=1'2'3
 */

$request = new Gongo\MercifulPolluter\Request;
$request->enableMagicQuotesGpc();
$request->pollute();

// $_GET['foo'] => "1\'2\'3"
//        $foo  => "1\'2\'3"

License

MIT License.

merciful-polluter's People

Contributors

andrewl64 avatar francislavoie avatar gongo avatar takapi86 avatar xelan avatar zonuexe avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar

merciful-polluter's Issues

Super global variables could be override by requests

This behavior is different from register_globals. And it might be a cause of security holes.

How to reproduce:

index.php

<?php
require __DIR__ . '/vendor/autoload.php';
(new Gongo\MercifulPolluter\Request)->pollute();
var_dump($_GET['foo'], $_GET['bar']);
var_dump($foo, $bar);

Access to http://example.com/?foo=123&bar=baz&_GET[foo]=Cracked&_GET[bar]=Cracked

Actual results:

string(7) "Cracked"
string(7) "Cracked"
string(3) "123"
string(3) "baz" 

Expected results:

string(3) "123"
string(3) "baz" 
string(3) "123"
string(3) "baz" 

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.