Php global variable vulnerability $ GLOBALS

There is such a section in the Discuz code:
If (isset ($ _ REQUEST ['globals']) OR isset ($ _ FILES ['globals']) {
Exit ('request tainting attempted .');
}
Register_globals is a control option in php. It can be set to off or on. The default value is off. It determines whether to register EGPCS (Environment, GET, POST, Cookie, Server) variables as global variables.
If register_globals is enabled, the data submitted by the client contains the GLOBALS variable name, which overwrites the $ GLOBALS variable on the server.
Therefore, this Code determines that if the submitted data contains the GLOBALS variable name, the program will be terminated.
 
The security problem caused by this becomes the "Automatic global variable Vulnerability" of PHP. Therefore, we must resolutely disable register_globals. Use $ _ GET, $ _ POST, $ _ COOKIE instead of $ _ REQUEST.
Discuz! The Forum bypasses global variable defense vulnerability because the default request_order value in php 5.3.x php. ini settings is GP, resulting in Discuz! In 6.x/7.x, global variable protection can be bypassed.
 
In include/global. func. php:
 
Function daddslashes ($ string, $ force = 0 ){
! Defined ('Magic _ QUOTES_GPC ') & define ('Magic _ QUOTES_GPC', get_magic_quotes_gpc ());
If (! MAGIC_QUOTES_GPC | $ force ){
If (is_array ($ string )){
Foreach ($ string as $ key => $ val ){
$ String [$ key] = daddslashes ($ val, $ force );
}
} Else {
$ String = addslashes ($ string );
}
}
Return $ string;
}
 
Include/common. inc. php:
 
Foreach (array ('_ cookies',' _ Post', '_ get') as $ _ request ){
Foreach ($ _ request as $ _ key => $ _ value ){
$ _ Key {0 }! = '_' & $ _ Key = daddslashes ($ _ value );
}
}
 
When register_globals = on, you can bypass the above Code by submitting the GLOBALS variable. To prevent this situation, Discuz! The following code is available:
 
If (isset ($ _ REQUEST ['globals']) OR isset ($ _ FILES ['globals']) {
Exit ('request tainting attempted .');
}
 
$ _ REQUEST the value of this super global variable is subject to php. the Influence of request_order in ini. In the latest php5.3.x series, the default value of request_order is GP, by default, $ _ REQUEST only includes $ _ GET and $ _ POST, but not $ _ COOKIE. You can use cookies to submit GLOBALS variables.
 
Temporary solution:
 
Change the php. ini settings in php 5.3.x and set request_order to GPC.
 
Supplement:
String substr (string, int start [, int length])
If 'start' is negative, it is counted back from the last character of the string to the start character.
If length is negative, it is counted back from the last character of the string to the length character as the end point.
If the string length is less than or equal to start, false is returned.
If the start point exceeds the end point, an empty string is returned.
 
Set_magic_quotes_runtime (0)
In php. in the ini configuration file, a Boolean value is set to magic_quotes_runtime. When it is enabled, most php functions are automatically introduced from the outside (including databases or files) overflow characters in the data plus backslash.
Of course, if you repeatedly Add a backslash to the overflow character, there will be multiple backlash in the string, so you need to use set_magic_quotes_runtime () and get_magic_quotes_runtime () to set and detect php. the magic_quotes_runtime status in the INI file.
In order to make your programs run normally regardless of the server settings. You can use get_magic_quotes_runtime to check and set the status autumn to determine whether to handle it manually, or use set_magic_quotes_runtime (0) at the beginning (or when automatic escape is not required.
Magic_quotes_gpc sets whether to automatically add a backslash to '"\ in the data sent by GPC (get, post, cookie. You can use get_magic_quotes_gpc () to detect system settings. If this setting is not enabled, you can use the addslashes () function to add a backslash before certain characters for database query statements. These characters are single quotation marks ('), double quotation marks ("), backslash (\), and NUL (NULL ).
 
Error_reporting (0)
// Turn off all error reporting
Error_reporting (0 );
Disable all error outputs.