Improve security for apc.php

September 23, 2008 / admin posted in php, security / No Comments

If you’re running APC with PHP, you have the option to download apc.php to view, monitor the usage/stats. However, the default authentication is very open. Without any credential, anyone can view the running stats and also the cached filenames (a simple search on “APC INFO” will show some site running APC). The login is to view per-directory file caching. So if you want to require login credential on ALL access change this code:

// authentication needed? // if (!USE_AUTHENTICATION) { $AUTHENTICATED=1; } else { $AUTHENTICATED=0; if (ADMIN_PASSWORD!=’password’ && ($MYREQUEST[‘LO’] == 1 || isset($_SERVER[‘PHP_AUTH_USER’]))) { if (!isset($_SERVER[‘PHP_AUTH_USER’]) || !isset($_SERVER[‘PHP_AUTH_PW’]) || $_SERVER[‘PHP_AUTH_USER’] != ADMIN_USERNAME || $_SERVER[‘PHP_AUTH_PW’] != ADMIN_PASSWORD) { Header(“WWW-Authenticate: Basic realm=\”APC Login\””); Header(“HTTP/1.0 401 Unauthorized”); echo <<<eob <html><body> <h1>Rejected!</h1> <big>Wrong Username or Password!</big> <big><a href='$PHP_SELF?OB={$MYREQUEST['OB']}'>Continue…</a></big> </body></html> EOB; exit; } else { $AUTHENTICATED=1; } } }

to this:

// 9/23/2008: Son Nguyen changed to always require auth for ANY info, not just Per-Dir $AUTHENTICATED=0; if (!isset($_SERVER[‘PHP_AUTH_USER’]) || !isset($_SERVER[‘PHP_AUTH_PW’]) || $_SERVER[‘PHP_AUTH_USER’] != ADMIN_USERNAME || $_SERVER[‘PHP_AUTH_PW’] != ADMIN_PASSWORD) { Header(“WWW-Authenticate: Basic realm=\”APC Login\””); Header(“HTTP/1.0 401 Unauthorized”); echo <<<eob <html><body> <h1>Rejected!</h1> <big>Wrong Username or Password!</big> <big><a href='$PHP_SELF?OB={$MYREQUEST['OB']}'>Continue…</a></big> </body></html> EOB; exit; } else { $AUTHENTICATED=1; }

< NO TAGS >

« pecl and memory limit errorjQuery not selecting nested elements »

Comments (0)

› No comments yet.

Pingbacks (0)

› No pingbacks yet.

mathie's bits