Have Geek Brain

PHP - disable global registers, what's best for fixing code?

I am working on an old codebase where programmers assume register_globals will always be on. Hence, variables are used without the $ _GET or $ _POST prefix, pretty much on every page (the code base is huge, hundreds of scripts). I tried to disable it, but the very first script (login script) goes into an infinite loop.

I understand that through one script at a time, and one line at a time, and fixing the variables is probably the only option (prefixing $ _GET or $ _POST as appropriate). Has anyone done this before? How did you do this? Any advice?

+2


a source to share


2 answers


It can do more harm than good, but:

  • Divide elements name="foo"

    from forms to CSV or separate line separator list and get attribute action

    (only if it refers to the actual script)
  • go to the CSV or line separated list and find find and replace with sed to replace $ currentval with $ _POST ['currentval'] / $ _ GET ['currentval'] or $ _REQUEST ['currentval'] (but be careful with cookies)

eg:

grep -o -E "(action|name)=\"[a-zA-Z0-9_]+\"" formfile.php | sed -E "s/.*\"([a-zA-Z0-9_]+)\"/\\1/" > vars.list


Gives you a list of separated lines (ish) that you can loop through in a bash script or whatever will replace vars.

EDIT

If you want to enable global registers for one site. Add to config .htaccess

or Apache:

php_value register_globals "On"

+1


a source


You can replicate register_globals

with the following code:

foreach ($_REQUEST as $var => $val) $$var = $val;

All you have to do is find a way to run this line before each script. You can do this in several ways:



  • Copy and paste it at the beginning of each file;
  • Using mod_rewrite

    in such a way that every request include (for example) register_globals.php?forward_to=originally_request_file.php

    where register_globals.php

    contains the above line declaration include file $_GET['forward_to']

    ;
  • There is a directive in your PHP configuration auto_prepend_file

    that will run a specific script before each file is run as usual. You could point it to a file with the above line. More details: http://php.net/auto-prepend-file

In addition to point (3), you can set this in the file .htaccess

like this:

php_value auto_prepend_file /var/www/register_globals.php
0


a source






More articles:


All Articles