views:

63

answers:

2

Hi, I am a beginner in PHP.

How can I restrict user access to controller.php and allow access to it only via view.php?


My proposal:

I don't know if this is proper, or how to avoid robots accessing it directly.


view.php:

  <?php
    session_start();
    $_SESSION['isFromView'] = true;
    ?>

  <html>
   <body>
    <form action="controller.php">
    <input type="submit"/>
    </form>
   </body>
  </html>

controller.php

<?php
   session_start();
   if(!isset($_SESSION['isFromView'])||!$_SESSION['isFromView']){exit();}
   else{

   //code here

   $_SESSION['isFromView']=false;
   }
?>

Please write what do I miss and in which way my controller can be access directly or other security problem (if you can examples please).


Edit:

In case that I dont have user login it can be secured by killing the session it controller.php after code executed, then when the user return to view.php new session ID will be created.

In most cases, though, we cannot kill the session because of other components of the site.

Thanks

+1  A: 

The solution proposed is fine. Alternative solutions:

  1. use some hash in some hidden field in view.php form (in view.php create some md5('secret') and then check that in controller.php). This solution is the most secure approach.
  2. check the referral url (I strongly disagree because it's security issues) - $_SERVER['HTTP_REFERER']. This variable can easily be spoofed (changed by the client) so it's a security risk to rely on it.
narcisradu
How can i check referral url ?
Yosef
you can find it in $_SERVER['HTTP_REFERER']
narcisradu
Why $_SERVER['HTTP_REFERER'] have security issue?(Can you give example please).
Yosef
I just edited my answer. $_SERVER['HTTP_REFERER'] might easily be spoofed by the client and this is the reason I said it's a security issue.
narcisradu
Ok I understand, what about first option hidden field?why it can be easily spoofed by client also, only if put the hidden id md5 to session variable its can not be spoofed r - or i have mistake? Can you write please or link to example that you mean about hidden field solution.
Yosef
<input type="hidden" value="<?php echo md5('some secret phrase')"> - If you submit the form, you will compare in controller.php md5('some secret phrase') with you value submitted by form.This solution cannot be spoofed.Only the http referrer might be spoofed by the client.The session method you provided is just fine. The hidden field solution is just another approach.
narcisradu
Ok, thanks you very much!
Yosef
+1  A: 

First thing of note is that it appears your usage of 'Controller' and 'view' seems to be radically different from mine - I would have interpreted this as being part of an MVC pattern - in which case the browser would never request 'view.php' it should be an include file invoked via include/require from the controller file. Also, as an include file, it should not contain any inline code - so even if it were directly accessible from a browser - it would not do anything when called from a browser.

If you simply mean that you have two scripts, and the second should only ever be called by the first, then the issue is one of Cross-site request forgery - there's lots and lots of discussions about how to avoid this on the internet, most of which will explain why using $_SERVER['HTTP_REFERER'] is a complete waste of time.

Passing transaction-related data via the session should be avoided at all costs - not least because of the problem of session aliasing.

C.

symcbean
its simple 2 scripts, not mvc project
Yosef