The following code is written in the php template:

 function langs($a) { $type_lang = $_GET['lang']; eval(file_get_contents("system/langs/$ type_lang.txt ")); return $worlds[$a]; }

Could he be dangerous with anything?

  • It would be nice to check that such a file exists, and that $type_lang consists only of letters and numbers. - ReinRaus
  • @ReinRaus, thanks! Conditions have already written :) - ModaL
  • 2
    And why eval in this situation, why not use include? - Chad

2 answers 2

Can. If the villain is aware of the device, and can somehow upload a text file to the server, albeit in a different folder, then calling shablon.php?lang=../../uploads/ evil.txt executes its code.

  • But in this case, I set a condition, saying that if lang! = Rus or eng, then the work is completed ... - ModaL
  • I answered the original question. If you allow only one of the hard-coded options, probably not so scary. Still, using eval() to load language strings is not the best solution. - Sergiks

Are you sure that your system does not have and never will appear any holes that allow you to write something to this very same $ type_lang.txt ?

If this happens, your script will immediately turn into a shell.

Conclusion: eval is safe only with static code inside

  • And for example what holes can be? I don't seem to give the opportunity to write something down there and do it myself manually .. - ModaL
  • "like". I have an iron rule - treat your code as if it would be used by your worst enemy. - Snow