12

I have a file in my Magento root that require_once 'app/Mage.php'; to give me access to Mage::getStoreConfig system variables.

Does this cause a security risk? Should I place it in another folder?

This is my file, /twitter.php:

<?php
require_once 'app/Mage.php';
Mage::app();
$consumer_key = Mage::getStoreConfig("Social/twitterapi/consumer_key");
$consumer_secret = Mage::getStoreConfig("Social/twitterapi/consumer_secret");
$oauth_access_token = Mage::getStoreConfig("Social/twitterapi/access_token");
$oauth_access_token_secret = Mage::getStoreConfig("Social/twitterapi/access_token_secret");
10

Unless the script contains means by which to alter content in the Magento install via something like arguments sent to the script then no I don't see that it's a security risk - including Mage.php is only exactly what index.php (also at web root) does too.

  • Thanks @Jonathan Hussey, that makes sence, didn't consider that index.php was using it – Holly Nov 17 '14 at 12:39
8

To add in a bit of additional paranoia, you could change the require statement to specify the app/Mage.php file using an absolute file system path, so the PHP include path is not used:

require __DIR__ . '/app/Mage.php';

Or, on PHP versions below 5.3:

require dirname(__FILE__) . '/app/Mage.php';

The very theoretical attack vector being that an attacker is able to somehow manipulate the PHP include path and thus is able to include arbitraty app/Mage.php files.

2

If you are the only one who will access this file, why not to IP-restrict if($_SERVER['REMOTE_ADDR']=='your.ip.address.here') it? I have seen many magento developers that keep such type of files in Magento root and do admin-related things without any kind of authentication. For example, I went to one of my friends Magento website and just guessed file at http://example.com/test.php and it gave me output Mail sent! lol. Developers also write sensitive things to change some database tables in standalone scripts as they want to do it once a while, and don't want to create a module for that.

I would suggest anyone who creates such type of standalone files which is only required to them, just IP-restrict it, and once your work is finished on that file just put an exit; on top of file. Just my 2 cents.

1

Creed Bratton,It will be always risky to call this type of code. Since you are call Mage.php from twitter.php , you need to put proper file permission for twitter.php. Or else any other user can rewrite your code of twitter.php. Other wise it does not create any issue.

  • Standard file permissions of 644 for this file should be fine. Remember also that PHP files only need read permission for the webserver user so if you did want to take advantage of this to restrict editing of the file for whatever reason then you could. – Jonathan Hussey Nov 17 '14 at 12:43
  • Thank @JonathanHussey... for your advice – Amit Bera Nov 17 '14 at 12:44
  • 2
    Why .. i got down vote.. Can explaing – Amit Bera Nov 17 '14 at 12:46
  • I hate when they don't explain the down vote. – sparecycle Nov 17 '14 at 20:00
  • This needs some clarification, could easily be misunderstood: 1) "user" in this context means a user on the server, i.e. somebody who already has access to the server. 2) this is not related at all to the fact that the file includes Mage.php. If somebody has access to your server and can write files, he could add the code in any file (or create a new one for example in /media, which is often set to 777) – Fabian Schmengler Nov 19 '14 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.