Is there a way to modify ioncube files to make it more secure - ioncube

Basically I want to set a script that unless user insert "?hithisisme" the ioncube won't run. However, I run afoul of their anti corruption file mechanism.

I think that anti corruption file mechanism uses also date of creation / date of modification so if you even add something to file and remove and date of file modification will change, there will be corrupted info (tested myself just right now) .
To achieve what you want you have to create .htaccess file with:
php_value auto_prepend_file prepend.php
and in prepend.php you have to put:
<?php
if (strpos($_SERVER['REQUEST_URI'], '?hithisisme') === false) {
exit;
}
On my localhost it works without any problems

Related

Disable file output of hydra

I'm using hydra to log hyperparameters of experiments.
#hydra.main(config_name="config", config_path="../conf")
def evaluate_experiment(cfg: DictConfig) -> None:
print(OmegaConf.to_yaml(cfg))
...
Sometimes I want to do a dry run to check something. For this I don't need any saved parameters, so I'm wondering how I can disable the savings to the filesystem completely in this case?
The answer from Omry Yadan works well if you want to solve this using the CLI. However, you can also add these flags to your config file such that you don't have to type them every time you run your script. If you want to go this route, make sure you add the following items in your root config file:
defaults:
- _self_
- override hydra/hydra_logging: disabled
- override hydra/job_logging: disabled
hydra:
output_subdir: null
run:
dir: .
There is an enhancement request aimed at Hydra 1.1 to support disabling working directory management.
Working directory management is doing many things:
Creating a working directory for the run
Changing the working directory to the created dir.
There are other related features:
Saving log files
Saving files like config.yaml and hydra.yaml into .hydra in the working directory.
Different features has different ways to disable them:
To prevent the creation of a working directory, you can override hydra.run.dir to ..
To prevent saving the files into .hydra, override hydra.output_subdir to null.
To prevent the creation of logging files, you can disable logging output of hydra/hydra_logging and hydra/job_logging, see this.
A complete example might look like:
$ python foo.py hydra.run.dir=. hydra.output_subdir=null hydra/job_logging=disabled hydra/hydra_logging=disabled
Note that as always you can also override those config values through your config file.

How do i locate wordpress plugin directory?

I am trying to add a function from plugin 1(wp job manager) to plugin 2(woocommerce).
I have decided to do this by including the php file from plugin 1, however I am unable to locate the file directory. I have used:
include( plugin_dir_path( __FILE__ ) . 'wp-job-manager/includes/class-wp-job-manager-applications.php');
but it returns the following error:
Warning:
include(/home/content/p3pnexwpnas05_data02/78/2394078/html/wp-content/themes/listify-child/wp-job-manager/includes/class-wp-job-manager-applications.php): failed to open stream: No such file or directory in
/home/content/p3pnexwpnas05_data02/78/2394078/html/wp-content/themes/listify-child/functions.php
on line 77
Please advise me as I've been stuck on this issue for really long... Thanks!!!
Wordpress setups have a constant ABSPATH defined (look at the bottom lines of wp_config.php) which points to the full and absolute path of the Wordpress setup, so in your case echo ABSPATH; would return /home/content/p3pnexwpnas05_data02/78/2394078/html/.
For most installations, appending wp-content/plugins/ to that string would point you to your plugins directory.
However, in a Wordpress configuration one can also customize the wp-content and or plugins directory to their own preference, so building plugins on ABSPATH.'wp-content/plugins/ is not recommended. Unfortunately Wordpress simply doesn't have a get_absolute_pluginspath() function or something available. A trick would be to fetch the plugins-URL, and remove the site-URL from it, so the remaining data is wp-content/plugins/ (or whatever the user has made of it). In code:
$plugins_directory = ABSPATH.str_replace(site_url()."/","",plugins_url())."/";
Which in your case would return:
/home/content/p3pnexwpnas05_data02/78/2394078/html/wp-content/plugins/
You probably mean:
plugin_dir_path(__FILE__)
That gives you the directory path to the file that statement is in. So what that returns depends on where you run it. If you use this statement
include( plugin_dir_path(__FILE__) . 'wp-job-manager/includes/class-wp-job-manager-applications.php');
in the main plugin file for wp_job_manager (probably wp_job_manager.php), then plugin_dir_path(__FILE__) give the path of the directory that file is in (the plugin directory).
If you use it in some other file, you will need to adjust the rest of the path string accordingly.

How should I protect a static Wordpress file directory from the outside world?

I'm taking over the admin of a WP site that serves static docs from a dedicated directory. The current directory resides on the top level (/public_html/docs) which seems susceptible to snooping. The site sits behind a login firewall.
The file directory contains >500 individual files, so uploading and hand-editing individual links seems absurd. (At least to me.)
Should I move this directory to a more secure location within the WP directory? Or, what is the preferred way to configure .htaccess?
At a minimum I would disable Directory Listing by using an .htaccess file that sits inside your /public_html/docs directory.
IndexIgnore *
Possibly a more secure method would be to move the docs directory outside your public_html directory. Then use a PHP script that can serve your document by passing a variable, such as www.site.com/serve_doc.php?name=xxxx.pdf.
Here is some code to accomplish this:
// get the file name
$file = $_GET['name'];
$dir = "/home/xxxx/docs/";
$fp = fopen($dir.$file, 'rb');
if(!$fp) { exit; }
// open the file
$finfo = finfo_open();
$filetype = finfo_file($finfo, $file, FILEINFO_MIME);
finfo_close($finfo);
$filename = $file;
// send the right headers
header("Cache-Control: ");// leave blank to avoid IE errors
header("Pragma: ");// leave blank to avoid IE errors
header("Content-Type: " .$filetype );
header('Content-Disposition: attachment; filename="'.$filename.'"');
header("Content-Length: " . filesize($dir.$file));
// dump the file and stop the script
fpassthru($fp);
exit();
Of course you'll want to add some authentication to validate whether the user should be able to call this PHP script. One possible way would be to call the Wordpress function is_user_logged_in in that script before serving the file.

How to/can not set php.ini values in run time using ini_set() method?

I am using nginx as web server and when I do phpinfo(); it uses /etc/php5/fpm/php.ini
Now in my php code I am trying to set file upload size and max file uploads using following code.
ini_set('max_file_uploads', "50");
ini_set('upload_max_filesize', '250M');
But when I do ini_get('max_file_uploads') and echo the value it shows the default value as 20, infact I am not able to change any of the ini values in run time using ini_set().
Any ideas on how to change these values in run time using php code?
Thanks.
Not all PHP ini directives can be changed at runtime (via ini_set). See the file uploads section of the PHP manual and the definition of the changeability values, which are PHP_INI_SYSTEM and PHP_INI_PERDIR for your desired settings, neither of which can be set at runtime.
To get these settings in only one part of your app, you'll likely need to compromise and set max_file_uploads setting globally in your php.ini file (since it is PHP_INI_SYSTEM), and then use your favorite per-directory config mechanism (.htaccess, .user.ini (in >5.3), etc) to set upload_max_filesize for that particular part of your app. See here for good instructions.

Drupal: The selected file intersection.png could not be uploaded

I don't understand why I get this error when I upload images...
The selected file intersection.png could not be uploaded. The file is not a known image format.
It is just a png file, and the problem came when I moved the website on the server. On localhost everything was perfect.
1) I've deleted the "files" folder and created it again with a php script (to make the server the owner)
2) drupal automatically creates 2 folders into it (imagecache and temp) so I assume it has the privilegies to write into it.
3) I've changed the temporary folder in Settings > Filesystem from "/tmp" to "temp", since I got an error before (probably the /tmp folder on the server is not writable by drupal
thanks
http://drupal.org/project/transliteration I think this module help me in my problem related this issue.
There's a known problem with Drupal 6.15 and IIS (see http://drupal.org/node/419734). If you're on 6.15, try backing down to 6.14 until a fix is completed.
I solved it. The rewrite module is not enabled on my IIS server, so I had to change a line of code inside the imagecache.module to add "index.php?q=
return url($GLOBALS['base_url'] . '/index.php?q=' . file_directory_path() .'/imagecache/'. $presetname .'/'. $path, $args);

Resources