tags:

views:

25

answers:

1

I am writing this in PHP

$edit_window = $database_info->timestamp + 86400;
$current_timestamp = time ();

if ($current_timestamp > $edit_window){
        $database_info->editable = TRUE;
     } 
else {
        $database_info->editable = FALSE;
     }

then

if ($database_info->editable){
//do some major stuff
}

Somehow this code is worrying me. Is it open to vulnerablities? Is there a better approach?

+1  A: 

It doesn't look vulnerable. Are you storing any user-provided data in the database (or inserting it into HTML) or relying on cookies or headers that could be spoofed?

alpha123
Well the database timestamp itself is created programmatically, but the current code is called by passing parameters in url, something like http://example.com/auth?some_id_parameter=3453656
RisingSun
Perhaps you want to make sure the parameters are "sanitized"...ie. not an invalid timestamp? (Pretty vague question=P)
I guess that my concerns are ill-founded. Thanks
RisingSun
Just validate the `some_id_parameter` to make sure it's what you think it is (an integer) and you'll be fine.
alpha123