Thank you Richard. I will test that (piping the output). Regarding my
concerns about "rubbing security" by not validating the included
code, I actually meant that the script does not validate where the
included PHP script is coming from. Could someone set the
environmental variable $_SERVER('PATH_TRANSLATED') from outside, so
to say? Or is there no reason to be worried?
/frank
4 aug 2006 kl. 22.22 skrev Richard Lynch:
Did you try to use "-" as the file and pipe the output?...
That might work...
As far as the Tidy not validating the included PHP, I'm not sure what
you mean, but I don't see this making the PHP code any less secure
than it was before you wrapped Tidy around it...
On Fri, August 4, 2006 6:21 am, Frank Arensmeier wrote:
Hello.
Since my ISP does not provide the tidy module for Apache, I tested
writing a wrapper script for a locally installed tidy binary. In
general, the script is triggered by a modification to the .htaccess
file like so:
AddHandler server-parsed .php
Action server-parsed /tidy_wrapper.php5
All php pages are by that means "treated" by the script
tidy_wrapper.php5.
Here is the code for tidy_wrapper.php5:
<?php
chdir ( dirname ( $_SERVER['PATH_TRANSLATED'] ) );
ob_start();
include ( $_SERVER['PATH_TRANSLATED'] );
$output = ob_get_contents();
ob_end_clean();
// Including a line with the commend "<!-- NO TIDY !-->" will turn
off tidy conversion
if ( !stristr ( $output, "<!-- NO TIDY !-->" ) ) {
$localfile = tempnam ( '../tmp', "tmp" );
$handle = fopen($localfile, "w");
fwrite($handle, $output);
fclose($handle);
$command = '/Library/WebServer/CGI-Executables/tidy -iq --show-
errors 0 --show-warnings 0 -wrap 100 ' . $localfile . ' 2>&1';
exec ( $command, $output_exec );
echo implode ( "\n", $output_exec );
unlink ( $localfile );
} else {
echo $output;
}
exit;
?>
Although the script is actually working fine, there is at least one
downside: speed. As you can see, the output buffer must be written to
a file in order to be processed by tidy. I was not able to get tidy
to accept a string for processing. Doing so, tidy throws en error. I
have looked through tidy documentation without finding any clues. I
would appreciate any hints. Any ideas for a walk-around for that file
saving-thing would be welcome!
Otherwise, I strongly feel that this script might become/be a
security hole. Because it does not validate the included PHP code, it
could be misused for doing bad stuff, or am I wrong? Once more, any
suggestions are welcome.
regards,
/frank
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
--
Like Music?
http://l-i-e.com/artists.htm
----------------------------------
Frank Arensmeier
Marketing Support & Webmaster
NIKE Hydraulics AB
Box 1107
631 80 Eskilstuna
Sweden
phone +46 - (0)16 16 82 34
fax +46 - (0)16 13 93 16
frank.arensmeier@xxxxxxxxxxxxxxxxx
www.nikehydraulics.se
