Trainee works for an Indian NGO - Help with PHP 4, staff counseling
For the past three months I have been working for an Indian NGO doing some volunteer work in this area but also trying to improve my website which requires a lot of work. I recently tried to fix the "subscribe to newsletter" button that was broken. I used filter_var to filter my email input, but when I tried to test this I got an error. Then I found out that the web host is still using php version 4.3.2 and register_globals is enabled.
I already mentioned that they should update their web host sooner. This would add a lot of complexity to a 3 person IT staff who would have to update all email (I assume this is a 250 person organization) and I found a new web host and taught them about it. The staff are not that sophisticated in using the Internet - the guy's head is still using IE6 and the website is laid out in tables (they use Dreamweaver WYSIWYG to arrange the pages).
So I have two options: use regular expressions to filter emails, which I am not good at (and will be more vulnerable to exploitation after I leave), disable the global registers, and then try to teach staff what I am doing , or try to get them to update their PHP and MySQL versions and / or change the web host. I would appreciate some advice.
Thanks for your help, Kevin
a source to share
First, I would make the application work correctly and as securely as possible in this environment, with regexes as needed.
Then I'll talk to the IT Pros. At some point they need to update their webpack, and this point has been around for a long time. PHP 4.3.2 is out and no longer supported (see here ). This means that if a vulnerability is found, it does not guarantee that it will receive a fix (although this is still quite likely due to the number of hosts not yet switched).
Better to make this switch than later.
It's not entirely clear from your description of how people in the organization use email (do they have their own email clients? They use webmail), but if they use their own email clients, the "only" problem will move mailboxes to the new host ...
While it can take a few painful days to move all mailboxes and redirects, and get everything to work, including setting each workstation to new data, it is not possible to do this and is unlikely to add long-term stress.
a source to share
What I will do: - fix your main problem as soon as possible: parse the email with regex, you can easily search with google - Discuss with the team about upgrading / migrating your host. Eliminating the email issue first lets you take your time with the issue.
I will not disable the global registers because there may be many more problems on other pages of the website. But it might stay on your todo list as it will be a good update.
a source to share
If security is really a big deal, you need to introduce a layer to deal with the intrusion problem. There are several options on the PHP site, but they all seem to require> 5.1.4. So I would look perhaps at installing mod_security if apache is running at the web server level. This way, your application will be protected not only from POST injections, but also GET injections and COOKIE exploits. Secondly, it will be proof of a future application if they add another form to it next week without your knowledge.
Sounds like you are tied to your hands and I will be honest with you if a company holds or intends to keep personal information about its users or confidential company information available to the app, security is not a series of hacks or fixes, it is serious commitment to a graceful and correct decision.
Good luck.
a source to share
The standard regex for checking RFC822 compliance is VERY ugly:
/^(?:[A-Za-z0-9!#$%&\'*+\/=?^_`{|}~-]+(?:\.[A-Za-z0-9!#$%&\'*+\/=?^_`{|}~-]+)*|"(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21\x23-\x5b\x5d-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])*")@(?:(?:[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?|\[(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?|[A-Za-z0-9-]*[A-Za-z0-9]:(?:[\x01-\x08\x0b\x0c\x0e-\x1f\x21-\x5a\x53-\x7f]|\\[\x01-\x09\x0b\x0c\x0e-\x7f])+)\])$/
from http://www.regular-expressions.info/email.html (hopefully it cut / pasted OK).
But realizing it will just delay your pain. A web host that lives on for days register_globals = on
should be reset as soon as possible. It's just begging to get undermined.
a source to share