PHP Script - For Opening a Document

Hawk Tuah · 16 Aug 2006 at 09:41

I'm looking for a script where I can pass a file name like

xxxxxx.co.uk/opener.php?testdocument.doc

and have it open the relevant document, and count the number of times its been opened.

I'm sure I could write something, but I just wondered if a script was was already around to do this.

Hawk Tuah · 16 Aug 2006 at 16:02

Not to worry. Stopped being lazy and wrote something to do it.

Hawk Tuah · 16 Aug 2006 at 17:10

Inquisitor said:
Be very careful with a script like that; it's a (very big) potential security hole if not done properly. Make sure that users can only access the files that you want them to be able to access, so they can't do something like this (assuming your files are kept in a subdirectory of the webroot):

Code:

http://insecurewebsite.co.uk/opener.php?file=../index.php

The most secure way of doing it would simply be to keep records of files in a database, and give them each an id, so you'd access them like so:

Code:

http://securewebsite.co.uk/opener.php?fileid=1

Thanks for the info. I see what you mean. Lucky I didn't put that live yet!

Ok, I've made a modification to try and prevent that. Fancy trying it out for me.. See if you think it's still vulnerable.

Hawk Tuah · 16 Aug 2006 at 18:00

Inquisitor said:
Can you post the code? Would make it easier to identify any security holes

Not publicly, but I'll happily mail it to you.

Hawk Tuah · 16 Aug 2006 at 19:35

Inquisitor said:
Do you have MSN? Would be easier to talk about it there than here if you don't want to disclose the source.

I've sent you the code.