GET request

Door jack maessen op 24-12-2012 20:15

5.853 views

ik zie dat ik een behoorlijk veiligheidslek heb op mijn website.
Het gaat om de volgende site: www.jackmaessen.nl
Je kunt inloggen met username:test en password: pass
Eenmaal ingelogd, klik in de navigatie op "My account"
Kijk vervolgens in de url en zie dat de username in de url wordt aangeroepen
(http://www.jackmaessen.nl/userinfo.php?user=test)
er is dus nu vrij gemakkelijk de info van andere leden te raadplegen door bv. in de url "test" te vervangen door "piet" of een andere naam. Dit mag natuurlijk nooit gebeuren.
Het script dat de info parsed ziet er als volgt uit:


                                <!-- MY ACCOUNT INFO -->


<?php
/**
 * UserInfo.php
 *
 * This page is for users to view their account information
 * with a link added for them to edit the information.
 *
 * Updated by: The Angry Frog
 * Last Updated: October 26, 2011
 */

if (!isset($_GET['user'])) { 
	header("Location: ".$config['WEB_ROOT'].$config['home_page']);
}
?>



<?php
/* Requested Username error checking */
$req_user = trim($_GET['user']);
if(!$req_user || strlen($req_user) == 0 ||
   !preg_match("/^[a-z0-9]([0-9a-z_-\s])+$/i", $req_user) ||
   !$database->usernameTaken($req_user)){
   die("Username not registered");
}

/* Logged in user viewing own account */
if(strcmp($session->username,$req_user) == 0){
   echo "<h6><br>My Account</h6>";
}
/* Visitor not viewing own account */
else{
   echo "<h6>User Info</h6>";
}

/* Display requested user information - add/delete as applicable */
$req_user_info = $database->getUserInfo($req_user);

/* Username */
echo "<b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Username: ".$req_user_info['username']."</b><br />";

/* Email */
echo "<b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Email:</b> ".$req_user_info['email']."<br />";

/**
 * Note: when you add your own fields to the users table
 * to hold more information, like homepage, location, etc.
 * they can be easily accessed by the user info array.
 
  * $session->user_info['location']; (for logged in users)

  * $req_user_info['location']; (for any user)
	*/
	
 
 
 
 

/* If logged in user viewing own account, give link to edit */
if(strcmp($session->username,$req_user) == 0){
   echo '';
}

/* Link back to main */
/*echo "<br>Back To [<a href='".$config['WEB_ROOT'].$config['home_page']."'>Main</a>]<br>";*/

?>
																										 <!-- EINDE MY ACCOUNT INFO -->

Hoe kan ik dit beveiligen?