Comments for MiracleBlue's Awesome Blog!

Comment on Security: The mindset of a secure programmer by Looie

Looie — Thu, 25 Feb 2010 19:02:09 +0000

Come on Nick, you can’t let RoR beat PHP!

Comment on Security: The mindset of a secure programmer by Havokade

Havokade — Wed, 20 Jan 2010 21:30:02 +0000

echo “mY c0d3 i$ 2 31337 4 u xP”;

Comment on Security: The mindset of a secure programmer by modsognir

modsognir — Sun, 10 Jan 2010 13:01:38 +0000

oh, to make things more condensed:
%w{home about contact destroyhumans}.include(@page) ? redirect_to @page : render :status=>404

Comment on Security: The mindset of a secure programmer by modsognir

modsognir — Sun, 10 Jan 2010 12:25:45 +0000

['home', 'about', 'contact', 'destroyhumans'].include?(@page) ? redirect_to :action=>@page : render :status=>404

Comment on Security: The mindset of a secure programmer by MiracleBlue

MiracleBlue — Sun, 10 Jan 2010 12:22:38 +0000

That’s pretty cool. Here’s a more condensed version of it in PHP…

(in_array($page, array(“home”,”about”,”contact”,”destroyhumans”)) ? include($dir.”/”.$page.”/php”) : include($dir.”/404.php”)

Comment on Security: The mindset of a secure programmer by modsognir

modsognir — Sun, 10 Jan 2010 12:19:04 +0000

In rails you can condense it to something like this (and i’m stretching it out a little)

@page = params[:page]

if ['home', 'about', 'contact', 'destroyhumans'].include?(@page)
redirect_to :action => @page
else
render :status => 404
end

Comment on Security: The mindset of a secure programmer by MiracleBlue

MiracleBlue — Sun, 10 Jan 2010 12:10:06 +0000

But *I* *LOVE* asterisks! *!!!*
=P
And no, it wouldn’t be all that difficult at all to do a whitelist. All you’d need to do is make an array. For example…

$whitelist = array(“home”, “about”, “contact”, “destroyhumans”);
if (in_array($page, $whitelist)) {
include($dir.”/”.$page.”.php”);
}
else {
include($dir.”/404.php”);
}

Comment on Security: The mindset of a secure programmer by modsognir

modsognir — Sun, 10 Jan 2010 11:08:57 +0000

I think its good. Maybe a bit much emphasis using asterisks.

In terms of the last section, I would also suggest using a whitelist of sorts – theres only so many pages that could be included, its worth testing if its one of those. If its not, throw a 404. Maybe a bit harder in php for lots of pages.

ah if only this was ruby

Comment on PHP Classes: A very quick guide to the basics by MiracleBlue

MiracleBlue — Fri, 08 Jan 2010 12:38:22 +0000

Coming in a later tutorial, when I can be bothered =]

Comment on PHP Classes: A very quick guide to the basics by ringosdom

ringosdom — Fri, 08 Jan 2010 10:35:54 +0000

but wheres the multiple inheritance and polymorphism?