Difference between revisions of "Talk:PHP Security Cheat Sheet"

Revision as of 21:56, 5 July 2012

NOTOC

__NOTOC__

I'd suggest to remove the TOC when this sheet is close to be finished. Achim, 3-jul-2012

TBD

I'm (mis-)using the {{TBD: ...}} wiki syntax to mark texts and paragraphs "to be discussed". Achim, 3-jul-2012

php.ini

I think your error configuration is not good. You have to set display_errors and display_startup_errors to On, otherwise it would be too hard to debug your code (yes you need debugging even on the server). The better practice, is to set to to On by default, and use a framework (a piece of code) to redirect that to a log for general user, and keep it on the screen for admins/developers. I've seen infinite developers set it to off, then set it to On for debugging, and leave it there.

OWASP makes suggestions for security not for compfy debugging. Security is the goal.

Hence Off is the choice for produktive systems. --Achim, 5-jul-2012

Why the hell is file_uploads off? Are you one of those guys who believe everything should be off to provide a secure system?

Yes (but there is a hint that some settings need to be adapted to real systems:) --Achim, 5-jul-2012

Also disabling functions and etc. its a very bad practice. This is only used in dull shared web hosting systems, and nobody gets their hosts.

Either we try to make a crappy PHP secure, or you have to live with brain-dead develpers using something like system($_REQUEST['killme'])

--Achim, 5-jul-2012

Most usage of PHP is available source code (Wordpress, Joomla, MyBB, etc.) and they all use these abilities. What you're indicating just says "dont follow this cheat sheet", no offence!

the cheat sheet is about security, not about using insecure frameworks. --Achim, 5-jul-2012

We gotta discuss session handling, there's a lot of issues there.

Allow_url_fopen Off is not secure at all. my most recent paper lists 12 methods of converting and LFI to a RFI, if somehow has an LFI flaw in the code, url_fopen On or Off wont matter.

Right. But if set on, it's definitely insecure and very easy to exploit. --Achim, 5-jul-2012

The memory and execution time limit defined there, is very bad practice. This limit kills the php script, and results in numerous errors which are extremely hard to debug. They do not mitigate DOS, you can simply run 10 scripts instead of 1. The optimum values are 32MB memory, 30 second execution time, with ability to extend it in user code.

It's a suggestion, feel free to adapt it to proper values. Just using the default may bring you to some risks. --Achim, 5-jul-2012

Please get back to me on this, or my email at [email protected]

--Abbas Naderi

PS. I really appreciate you working on this page, ignore my rude tone!

LOL