微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦!

php – CodeIgniter应用程序中的URL安全性

免责声明:我是网络开发的新手.

场景:我使用CodeIgniter构建了一个应用程序,最好将其描述为事件日历.应用程序中有一个共享功能,允许您与其他人共享您的活动日历.登录后,用户可以前往共享页面,并从与他们共享活动日历的人员列表中进行选择.目前,当用户选择与他们共享活动日历的人员的姓名时,会生成以下URI:

http://example.com/folder/controller/method/id

id部分是与个人共享其日历的用户数据库中的owner_id.

问题:很容易将URL的id部分更改为数据库中的另一个用户的owner_id.这允许这样做的人访问未授权共享其活动日历的个人的活动日历.

问题:解决此安全漏洞的方法有哪些?如果还有其他我需要提供的内容,或者以更清晰的方式解释,请告诉我.提前感谢您的时间和精力.

模型:

class Shares_model extends crud_model {

    public function __construct()
    {
        parent::__construct();

        $this->pk = 'id';
        $this->table_name = 'shares';
    }

    public function get($shared_to_user_id)
    {
        $this->db->where('shared_to_id',$shared_to_user_id);
        $ids = parent::get_all();

        $users = array();

        foreach ($ids as $id)
        {
            $users[$id->owner_id]['owner_id'] = $id->owner_id;
            $users[$id->owner_id]['owner_first_name'] = $id->owner_first_name;
            $users[$id->owner_id]['owner_last_name'] = $id->owner_last_name;
        }

        return $users;
    }   
}

视图:

<div class="panel">
    <h4>Shared Planners</h4>
        <ol>
            <?PHP foreach($sharers as $s): ?>
            <li><a href="<?PHP echo base_url('user/shared/view/'.$s['owner_id']) ?>"><strong><?PHP echo $s['owner_first_name']." ".$s['owner_last_name'] ?></strong></a></li>
            <?PHP endforeach; ?>
        </ol>
</div>

控制器:

class Shared extends Common_Auth_Controller {

    private $end_user;

    public function __construct()
    {
        parent::__construct();

        $this->end_user = $this->ion_auth->user()->row();
        $data['end_user'] = $this->end_user;
        $this->load->vars($data);

        $this->load->model('events_model','events');
    }

    public function index()
    {
        $title['title'] = 'Shared';

        $this->load->model('shares_model','shares');

        $data['sharers'] = $this->shares->get($this->end_user->id);

        $this->load->view('public/head_view',$title);
        $this->load->view('user/header_view');
        $this->load->view('user/shared_view',$data);
        $this->load->view('user/footer_view');
    }

解决方法

使用以下逻辑

<?PHP
            // Check if user is logged in 
            if (!$this->ion_auth->logged_in())
            {
                //Not logged in,so redirect them to login page
                redirect('account/login','refresh');
            }

            else{
            // So the user is logged in 
            // Get the id of the currently logged in user ( The user who is trying to view the page )
            $current_user = $this->ion_auth->get_user();
            $current_userid = $current_user->id;


            // you need an array of users who have been invited to that event by the event creator
            // As you mentioned you are storing the users who have been invited in db,get the ids to an array 

            $invited_users = getIdsOfusers();

            if (in_array($current_userid,$invited_users)) {
                // Yes,The user who is trying to view the page has access
                // you can show him the respective view
            }
            else {
                // No,The user who is trying to view the page Doesn't have  access
                show_error('You dont have access !',500 );
            }
    }

    ?>

版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。

相关推荐