Improve security for apc.php

If you’re running APC with PHP, you have the option to download apc.php to view, monitor the usage/stats. However, the default authentication is very open. Without any credential, anyone can view the running stats and also the cached filenames (a simple search on “APC INFO” will show some site running APC). The login is to view per-directory file caching. So if you want to require login credential on ALL access change this code:

// authentication needed? // if (!USE_AUTHENTICATION) { $AUTHENTICATED=1; } else { $AUTHENTICATED=0; if (ADMIN_PASSWORD!=’password’ && ($MYREQUEST[‘LO’] == 1 || isset($_SERVER[‘PHP_AUTH_USER’]))) { if (!isset($_SERVER[‘PHP_AUTH_USER’]) || !isset($_SERVER[‘PHP_AUTH_PW’]) || $_SERVER[‘PHP_AUTH_USER’] != ADMIN_USERNAME || $_SERVER[‘PHP_AUTH_PW’] != ADMIN_PASSWORD) { Header(“WWW-Authenticate: Basic realm=\”APC Login\””); Header(“HTTP/1.0 401 Unauthorized”); echo <<<eob <html><body> <h1>Rejected!</h1> <big>Wrong Username or Password!</big> <big><a href='$PHP_SELF?OB={$MYREQUEST['OB']}'>Continue…</a></big> </body></html> EOB; exit; } else { $AUTHENTICATED=1; } } }

to this:

// 9/23/2008: Son Nguyen changed to always require auth for ANY info, not just Per-Dir $AUTHENTICATED=0; if (!isset($_SERVER[‘PHP_AUTH_USER’]) || !isset($_SERVER[‘PHP_AUTH_PW’]) || $_SERVER[‘PHP_AUTH_USER’] != ADMIN_USERNAME || $_SERVER[‘PHP_AUTH_PW’] != ADMIN_PASSWORD) { Header(“WWW-Authenticate: Basic realm=\”APC Login\””); Header(“HTTP/1.0 401 Unauthorized”); echo <<<eob <html><body> <h1>Rejected!</h1> <big>Wrong Username or Password!</big> <big><a href='$PHP_SELF?OB={$MYREQUEST['OB']}'>Continue…</a></big> </body></html> EOB; exit; } else { $AUTHENTICATED=1; }

Improve security for apc.php

Comments

Leave a Reply Cancel reply