Prevention of php webshell URLs. For example, the following WEB application may display sensitive information to login users: Copy the code as follows :? Php $ authenticatedFALSE; $ authenticatedcheck_auth (); if ($ authenticated) {inclu for example, the following WEB application may display sensitive information to login users:
The code is as follows:
$ Authenticated = FALSE;
$ Authenticated = check_auth ();
If ($ authenticated)
{
Include './sensitive. php ';
}
?>
Because sensitive. php is located in the home directory of the website, the file can be directly accessed by skipping the authentication mechanism in the browser. This is because all files in the home directory of the website have a corresponding URL address. In some cases, these scripts may execute an important operation, which increases the risk.
To prevent webshell URLs, make sure that all the files contained are stored outside the home directory of the website. All files stored in the home directory of the website must be directly accessed through URLs.
The pipeline code is as follows :? Php $ authenticated = FALSE; $ authenticated = check_auth (); if ($ authenticated) {inclu...
