12

I have a file in my Magento root that require_once 'app/Mage.php'; to give me access to Mage::getStoreConfig system variables.

Does this cause a security risk? Should I place it in another folder?

This is my file, /twitter.php:

<?php
require_once 'app/Mage.php';
Mage::app();
$consumer_key = Mage::getStoreConfig("Social/twitterapi/consumer_key");
$consumer_secret = Mage::getStoreConfig("Social/twitterapi/consumer_secret");
$oauth_access_token = Mage::getStoreConfig("Social/twitterapi/access_token");
$oauth_access_token_secret = Mage::getStoreConfig("Social/twitterapi/access_token_secret");
Improve this question

4 Answers 4

Reset to default
10

Unless the script contains means by which to alter content in the Magento install via something like arguments sent to the script then no I don't see that it's a security risk - including Mage.php is only exactly what index.php (also at web root) does too.

Improve this answer
1
  • Thanks @Jonathan Hussey, that makes sence, didn't consider that index.php was using it
    – Holly
    Commented Nov 17, 2014 at 12:39
8

To add in a bit of additional paranoia, you could change the require statement to specify the app/Mage.php file using an absolute file system path, so the PHP include path is not used:

require __DIR__ . '/app/Mage.php';

Or, on PHP versions below 5.3:

require dirname(__FILE__) . '/app/Mage.php';

The very theoretical attack vector being that an attacker is able to somehow manipulate the PHP include path and thus is able to include arbitraty app/Mage.php files.

Improve this answer
3

If you are the only one who will access this file, why not to IP-restrict if($_SERVER['REMOTE_ADDR']=='your.ip.address.here') it? I have seen many magento developers that keep such type of files in Magento root and do admin-related things without any kind of authentication. For example, I went to one of my friends Magento website and just guessed file at http://example.com/test.php and it gave me output Mail sent! lol. Developers also write sensitive things to change some database tables in standalone scripts as they want to do it once a while, and don't want to create a module for that.

I would suggest anyone who creates such type of standalone files which is only required to them, just IP-restrict it, and once your work is finished on that file just put an exit; on top of file. Just my 2 cents.

Improve this answer
1

Creed Bratton,It will be always risky to call this type of code. Since you are call Mage.php from twitter.php , you need to put proper file permission for twitter.php. Or else any other user can rewrite your code of twitter.php. Other wise it does not create any issue.

Improve this answer
5
  • Standard file permissions of 644 for this file should be fine. Remember also that PHP files only need read permission for the webserver user so if you did want to take advantage of this to restrict editing of the file for whatever reason then you could.
    – Jonathan Hussey
    Commented Nov 17, 2014 at 12:43
  • Thank @JonathanHussey... for your advice
    – Amit Bera ♦
    Commented Nov 17, 2014 at 12:44
  • 2
    Why .. i got down vote.. Can explaing
    – Amit Bera ♦
    Commented Nov 17, 2014 at 12:46
  • I hate when they don't explain the down vote.
    – sparecycle
    Commented Nov 17, 2014 at 20:00
  • This needs some clarification, could easily be misunderstood: 1) "user" in this context means a user on the server, i.e. somebody who already has access to the server. 2) this is not related at all to the fact that the file includes Mage.php. If somebody has access to your server and can write files, he could add the code in any file (or create a new one for example in /media, which is often set to 777)
    – Fabian Schmengler
    Commented Nov 19, 2014 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.