Require_once and fopen in php security -


i have 1 file i've implemented in php. error

warning: require_once(): http:// wrapper disabled in server configuration allow_url_include=0 in /applications/mamp/htdocs/opencart/catalog/view/theme/default/template/payment/bank_transfer.tpl on line 13warning:

questions:

  1. i know need fix allowing allow_url_include=0, in php.ini.i'm using mamp, i've searched folders in mamp , mamp pro, didn't find line, can set value 0. do add line?

  2. i've read link , i'm worried there security issues using require_once, fopen , absolute url. there security issues using absolute url , require_once?

  3. how can specify url document? it's www.example.com/opencart/admin/kzm/kzm.utils.php, tried use relative url /opencart/admin/kzm/kzm.utils.php, didn't find file. doing right?

bank_transfer.tpl: 

<h2><?php echo $text_instruction; ?></h2>     <div class="content">           <p><?php echo $text_description; ?></p>           <p><?php echo $bank; ?></p>           <p><?php echo $text_payment; ?></p>           <p><?php echo $orderidkzm; ?></p>           <p>           <?php              echo $amountkzm;              $titlekzm = $titlekzm.$orderidkzm;              echo '<br>';              require_once('http://example.com/opencart/admin/kzm/kzm.utils.php');             echo $titlekzm;             echo '<br>';              $merchantidkzm = '10';             $currencykzm = 'kzt';             $successurlkzm = 'http://localhost:8888/opencart/admin/kzm/kzm_pay.php';             $errourlkzm = 'http://www.google.com';              $datekzm = " ";             $signstrkzm = " ";             $verkzm = " ";             echo $merchantidkzm.'-'.$currencykzm.'-'.$successurlkzm.'-'.$errourlkzm.'-'.$datekzm;            ?></p>     </div>     <div class="buttons">       <div class="right">             <form action="/opencart/testkzm.php" method="get">                 <input type="hidden" name="merchantidkzm" value="<?php echo $merchantidkzm; ?>">                 <input type="hidden" name="orderidkzm" value="<?php echo $orderidkzm; ?>">                 <input type="hidden" name="amountkzm" value="<?php echo $amountkzm; ?>">                 <input type="hidden" name="currencykzm" value="<?php echo $currencykzm; ?>">                 <input type="hidden" name="successurlkzm" value="<?php echo $successurlkzm; ?>">                 <input type="hidden" name="errorurlkzm" value="<?php echo $errorurlkzm; ?>">                 <input type="hidden" name="signstrkzm" value="<?php echo $signstrkzm; ?>">                 <input type="hidden" name="verkzm"  value="<?php echo $verkzm; ?>">                  <input type="submit" value="<?php echo $button_confirm; ?>" id="button-confirm" class="button" />             </form>         </div>     </div>

changing allow_url_include=1 not safe. it's set disabled default.

when include on local machine use can ported across platforms. hardcoding include below web root can lead mandatory rewrites if you're on shared hosting plan or if don't control server. more portable dev/production environment.

<?php      require_once($_server['document_root'].'/opencart/admin/kzm/kzm.utils.php');  ?>

if need directory can this:

<?php      require_once($_server['document_root'].'/../website2_folder/opencart/admin/kzm/kzm.utils.php');  ?>

Comments

Post a Comment

Popular posts from this blog

monitor web browser programmatically in Android? -

i've got tricky question here. need users make payment bank (namely barclaycard) in uk. so, have https url , add parameters (such amount pay, order reference, etc) url, start http connection intent.actionview, redirect user browser can enter credit card details on bank's webpage , make payment our account successfully. far ? the code use below (i changed values privacy reasons) problem is, need app when user has completed/failed/cancelled payment. barclaycardautomatically redirects particular url when payment has succeeded, 1 if failed. there no way of knowing when barclaycard payment has succeeded go android app somehow ? button cardbutton = (button) findviewbyid(r.id.card_button); cardbutton.setonclicklistener(new view.onclicklistener() { @override public void onclick(view arg0) { string prehashstring = new string(); string prohashstring = new string(); string shapassphrase = new string(); shapassphrase = "gsvth£h70zkh...
Read more

Shrink a YouTube video to responsive width -

i have youtube video embedded on our website , when shrink screen tablet or phone sizes stops shrinking @ around 560px in width. standard youtube videos or there can add code make go smaller? you can make youtube videos responsive css. wrap iframe in div class of "videowrapper" , apply following styles: .videowrapper { float: none; clear: both; width: 100%; position: relative; padding-bottom: 56.25%; padding-top: 25px; height: 0; } .videowrapper iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; } the .videowrapper div should inside responsive element. padding on .videowrapper necessary keep video collapsing. may have tweak numbers depending upon layout.
Read more

wpf - PdfWriter.GetInstance throws System.NullReferenceException -

i'm trying create pdf document using itextsharp 5.3.4 using following document document = new document(); filestream stm = new filestream(filename, filemode.create); pdfwriter writer = pdfwriter.getinstance(document, stm); i'm getting system.nullreferenceexception following stack trace: system.nullreferenceexception occurred hresult=-2147467261 message=la référence d'objet n'est pas définie à une instance d'un objet. source=itextsharp stacktrace: à itextsharp.text.version.getinstance() innerexception: i've verified neither document nor stm null, , if select "continue" in vs12 document created - exception thrown. updated itextsharp 5.4.0 , it's still occurring. can't find information on anywhere - got ideas? make sure not catching exceptions. nullreferenceexception can 1 caught , handled inside itextsharp, don't care it. fact can continue supports theory. change following setting verify: debug -> exceptions ...
Read more