I want to capture as much simple information on a web request with just PHP. What variables are available for me to store? Here's what I have so far:
https://gist.github.com/1363218
My wishlist for this function:
Turns language into an associative array ordered by weight
Add full name to language
Break server software into an associative array
Get the exact version of the platform, e.g., 'Windows 7 SP1' instead of just 'Windows'
Classify the request as being from a mobile device, a tablet, or a desktop
Am I missing anything else that could be useful?
Every information available to you are in variables, so an easy way to find the stuff you want is to have a look at $GLOBALS. Create a new PHP file and do print_r($GLOBALS);, and you'll see every information your script has gathered.
This includes everything from http headers (charset, encoding, language) to cookies, browser and operating system.
Take what you need: http://php.net/manual/en/reserved.variables.php
PHP_SELF /blog/article.php
GATEWAY_INTERFACE CGI/1.1
SERVER_ADDR Server IP: 217.112.82.20
SERVER_NAME www.URL.co.uk
SERVER_SOFTWARE Apache/2.2.15 (Win32) JRun/4.0 PHP/5.2.13
SERVER_PROTOCOL HTTP/1.0
REQUEST_METHOD GET / POST / PUT / HEAD
REQUEST_TIME Request start time: 1280149029
QUERY_STRING id=10&user=foo
DOCUMENT_ROOT /path/to/your/server/root/
HTTP_ACCEPT text/html,application/xhtml+xml,application/xml;q=0.9
HTTP_ACCEPT_CHARSET ISO-8859-1,utf-8;q=0.7,*;q=0.7
HTTP_ACCEPT_ENCODING gzip,deflate
HTTP_ACCEPT_LANGUAGE en-gb,en;q=0.5
HTTP_CONNECTION keep-alive
HTTP_HOST www.URL.co.uk
HTTP_REFFERER http://previous.url.com
HTTP_USER_AGENT Mozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6 ( .NET CLR 3.5.30729)
HTTPS 1
REMOTE_ADDR 193.60.128.69
REMOTE_HOST Client server's host name
REMOTE_PORT 5390
SCRIPT_FILENAME /path/to/this/script.php
SERVER_ADMIN webmaster#URL.co.uk
SERVER_PORT 80
SERVER_SIGNATURE Version signature: 5.123
SCRIPT_NAME /blog/article.php
REQUEST_URI /blog/article.php
$_SERVER['HTTP_USER_AGENT'].
This can you about user's operating system, as well as their browser.
For example
Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en)
Related
I am new to posting here, so sorry if I don't make it how it should be, and I could not decide what to make the title.
So, I am new to Nginx and Docker, I am wanting to use Nginx Proxy Manager to proxy all my websites that are hosted on 'php:8.1-apache' images for now.
I am proxying a website from a docker container (Named 'ApacheDefault') running a custom image of 'php:8.1-apache' through Nginx Proxy Manager (Assets Caching disabled, Block Common Exploits disabled), and I am having issues when going through the proxy that does not appear when reaching straight to the website.
When reaching through the proxy, it randomly works and then stops working.
On the root of my website, I got /test.php which is just the phpinfo function, /index.php which handle the routing, some assets in the /assets/ folder, and a /.htaccess with
Options +FollowSymLinks
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?url=$1 [QSA,L]
Using 'my.domain' as an example, my domain is using Cloudflare DNS.
When reaching my.domain/test.php, I either get the regular phpinfo page or a page with this:
Warning: require_once(assets/php/config.php): Failed to open stream: No such file or directory in /var/www/html/assets/php/content.php on line 2
Fatal error: Uncaught Error: Failed opening required 'assets/php/config.php' (include_path='.:/usr/local/lib/php') in /var/www/html/assets/php/content.php:2 Stack trace: #0 /var/www/html/index.php(19): include() #1 /var/www/html/assets/php/classes/Route.php(37): {closure}('test.php') #2 /var/www/html/assets/php/classes/Router.php(40): Route->call() #3 /var/www/html/index.php(23): Router->run() #4 {main} thrown in /var/www/html/assets/php/content.php on line 2
^ "/var/www/html/assets/php/content.php" is not a file that does not exists and "assets/php/config.php" is never called in my code
The Nginx Proxy Manager log shows this (The first line landed on the error page, the second showed the regular phpinfo page):
[07/Oct/2022:16:20:22 +0000] - 200 200 - GET https my.domain "/test.php" [Client X.X.X.X] [Length 339] [Gzip -] [Sent-to ApacheDefault] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" "-"
[07/Oct/2022:16:20:23 +0000] - 200 200 - GET https my.domain "/test.php" [Client X.X.X.X] [Length 23591] [Gzip -] [Sent-to ApacheDefault] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" "-"
For some reason, the Length changes, and I can't get to understand why.
I tried:
Disabling Nginx caching from "Custom Nginx Configuration".
Disabling Nginx GZip (from "Custom Nginx Configuration") but could not manage to do it.
Enabling Cloudflare's Development Mode.
Thank you to anyone that can bring me the slightest help!
EDIT:
After testing a bit more I noticed something. When defining NPM (Nginx Proxy Manager)'s "Forward Hostname / IP" to my server raw IP or the website docker container's IP, the error does not appear anymore. The error only appears when using the docker container name as hostname instead of its IP. But I would like to rely on the hostname and not the IP because the IP can change, and seeing hostname is easier.
RE EDIT:
After removing my initial network connecting NPM & The Website Container and re creating it, it seems like it fixed the issue.
No idea why but i dont care, its fixed !
As new Opera 65 came few days ago with address bar redesign, I have noticed an issues on my web page.
While typing or copying an address into the bar, Opera sends requests to server, however, I am not able to capture the requests in PHP, as it seems, Fetch API is used under the hood.
Is there any way to deny or block the Fetch API requests in PHP 7 or Apache 2.4? In other words, block the requests on server side produced by Opera while typing / copying (PHP preferred)?
Particularly, I need to exclude GET requests providing an action with hash key in a query (test in the sample bellow).
When the address is copied (from mail for e.g.) to the address bar, Opera sends the request "in the background", the request is executed, however after submitting the address by Enter, second request returns error, because of forbidden operation (hash key is not valid anymore).
From Apache log:
127.0.0.1 - - [29/Nov/2019:01:56:08 +0100] "GET /? HTTP/1.1" 200 179736
127.0.0.1 - - [29/Nov/2019:01:56:08 +0100] "GET /?t HTTP/1.1" 200 179813
127.0.0.1 - - [29/Nov/2019:01:56:08 +0100] "GET /?te HTTP/1.1" 200 179808
127.0.0.1 - - [29/Nov/2019:01:56:08 +0100] "GET /?tes HTTP/1.1" 200 179819
127.0.0.1 - - [29/Nov/2019:01:56:08 +0100] "GET /?test HTTP/1.1" 200 179823
From Wireshark (one of the requests):
/?test HTTP/1.1
Host: sk.localhost
Connection: keep-alive
Sec-Fetch-Site: none
Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 OPR/65.0.3467.48
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Used technologies:
PHP 7.3.7, Apache/2.4.39
The requests can be denied (response sent) by Apache rewrite conditions or PHP response based on parsed headers.
Opera sends two Fetch API headers while typing:
Sec-Fetch-Site: none
Sec-Fetch-Mode: no-cors
List of all headers can be found at https://w3c.github.io/webappsec-fetch-metadata/.
To not sent a full response (not engage PHP) for requests with this headers, you can use Apache 2.4 mod rewrite module:
RewriteCond %{HTTP:Sec-Fetch-Site} ^none$ [NC]
RewriteCond %{HTTP:Sec-Fetch-Mode} ^no-cors$ [NC]
RewriteRule ^ - [R=204,L]
or send response via PHP (sample using Kohana/Koseven FW):
$header_sec_fetch_site = $this->request->headers('Sec-Fetch-Site');
$header_sec_fetch_mode = $this->request->headers('Sec-Fetch-Mode');
if (isset($header_sec_fetch_site, $header_sec_fetch_mode)
&& $header_sec_fetch_site == 'none'
&& $header_sec_fetch_mode == 'no-cors')
{
$message = 'Header ' . $header_sec_fetch_mode . ' received. No content for this request.';
Log::instance()->add(Log::NOTICE, $message);
throw HTTP_Exception::factory(204, $message, array(
':uri' => Request::current()->uri(),
));
}
The headers should be available in global variables:
$_SERVER['HTTP_SEC_FETCH_DEST']
$_SERVER['HTTP_SEC_FETCH_SITE']
$_SERVER['HTTP_SEC_FETCH_USER']
$_SERVER['HTTP_SEC_FETCH_MODE']
I stumbled across an issue while setting up LDAP for Dokuwiki using the authldap plugin. I run dokuwiki with php7.2 on Ubuntu 18.4 and have windows server 2016 as an active directory controller.
I have several services running that sucessfully use LDAP and i can use the tool "ldapsearch" to contact the Active directory host from the command line of the same machine that runs dokuwiki. Thus I assume that at least the connection should be alright.
So far I narrowed it down to the ldap_connect(server,port) method in the file /lib/plugins/authldap/auth.php
$this->con = #ldap_connect($server, $port);
This call returns -1 . An echo of $server and $port show the correct ip address and port.
I've run out of ideas how to debug this issue and would be very thankful for suggestions.
Thanks & greetings
[Update]
Upon suggestion I removed the silence flag. I could not find changes in any log giving further hints.
I have another log I havent properly looked at:
192.168.4.103 - - [06/Jan/2019:15:51:15 +0000] "POST /dokuwiki/doku.php?id=start&do=login§ok= HTTP/1.0" 403 11344 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
192.168.4.103 - - [06/Jan/2019:15:51:15 +0000] "GET /dokuwiki/lib/exe/indexer.php?id=start&1546789875 HTTP/1.0" 200 42 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36"
For me this looks like there was a sucessful request (http code 200), followed by a 403, suggesting that this action was forbidden.
I assume this is a default answer due to the failed ldap_connect
I have successfully cloned a laravel from a git repo into a new folder, and I have successfully run database migrations& seeds.
I also deleted vendor folder, and run: $composer install --dev
Although my routes.php is simple:
<?php
Route::get('/', 'BlogController#getIndex');
I try to visit my page as:
http://localhost:8080/widgets-repository-contribution%20/public/
I get this error:
Symfony \ Component \ HttpKernel \ Exception \ NotFoundHttpException
I also tried to restart the server, but no luck ..
Any idea?
for full trace:
Server/Request Data
REDIRECT_OPENSSL_CONF C:\Bitnami\wampstack-5.4.37-0/apache2/conf/openssl.cnf
REDIRECT_PATH C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\jZip;C:\HaxeToolkit\haxe\;C:\HaxeToolkit\neko;C:\Program Files\Microsoft\Web Platform Installer\;C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Pages\v1.0\;C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\;C:\Program Files\Microsoft SQL Server\110\Tools\Binn\;C:\Bitnami\wampstack-5.4.37-0\php;C:\ProgramData\ComposerSetup\bin;;C:\Bitnami\wampstack-5.4.37-0/apache2/bin;
REDIRECT_STATUS 200
OPENSSL_CONF C:\Bitnami\wampstack-5.4.37-0/apache2/conf/openssl.cnf
PATH C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\jZip;C:\HaxeToolkit\haxe\;C:\HaxeToolkit\neko;C:\Program Files\Microsoft\Web Platform Installer\;C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Pages\v1.0\;C:\Program Files (x86)\Windows Kits\8.0\Windows Performance Toolkit\;C:\Program Files\Microsoft SQL Server\110\Tools\Binn\;C:\Bitnami\wampstack-5.4.37-0\php;C:\ProgramData\ComposerSetup\bin;;C:\Bitnami\wampstack-5.4.37-0/apache2/bin;
HTTP_HOST localhost:8080
HTTP_CONNECTION keep-alive
HTTP_CACHE_CONTROL max-age=0
HTTP_ACCEPT text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
HTTP_USER_AGENT Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36
HTTP_ACCEPT_ENCODING gzip, deflate, sdch
HTTP_ACCEPT_LANGUAGE ar,en-US;q=0.8,en;q=0.6
HTTP_COOKIE laravel_session=eyJpdiI6Inp0ZnZOZDhIcFFKS2FBejZNeEthNlE9PSIsInZhbHVlIjoiVHlKUzI2bkFrZGhkS0lFRXdqMEMrUUNXRWNcL2JORnY5OVVmOHF1d0NrbXE4K21zMkVabFpNMXFyN0Vhb2U1ZXVMVmlDUUpHZUMzV0hYUzExUnVlVGVBPT0iLCJtYWMiOiI2YjMzZTlkMTNmNjhhNmVmNjY3NDYxYTEwZjYzNWNmNjY2N2RjYjE5NWEwODgzMzY1NTMzZjZjMjZkNzRmMTg5In0%3D
SystemRoot C:\Windows
COMSPEC C:\Windows\system32\cmd.exe
PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
WINDIR C:\Windows
SERVER_SIGNATURE
SERVER_SOFTWARE Apache
SERVER_NAME localhost
SERVER_ADDR ::1
SERVER_PORT 8080
REMOTE_ADDR ::1
DOCUMENT_ROOT C:/Bitnami/wampstack-5.4.37-0/apache2/htdocs
REQUEST_SCHEME http
CONTEXT_PREFIX
CONTEXT_DOCUMENT_ROOT C:/Bitnami/wampstack-5.4.37-0/apache2/htdocs
SERVER_ADMIN admin#example.com
SCRIPT_FILENAME C:/Bitnami/wampstack-5.4.37-0/apache2/htdocs/widgets-repository-contribution/public/index.php
REMOTE_PORT 57801
REDIRECT_URL /widgets-repository-contribution /public/
GATEWAY_INTERFACE CGI/1.1
SERVER_PROTOCOL HTTP/1.1
REQUEST_METHOD GET
QUERY_STRING
REQUEST_URI /widgets-repository-contribution%20/public/
SCRIPT_NAME /widgets-repository-contribution/public/index.php
PHP_SELF /widgets-repository-contribution/public/index.php
REQUEST_TIME_FLOAT 1427016178.277
REQUEST_TIME 1427016178
"public" is not part of the url and space (%20) in url is also strange. You must access http://localhost:8080/widgets-repository-contribution
php artisan route:list will show you all routes that have been correctly defined for doublechecking.
I hope I can be brief and still allow you to understand the actual problem.
Here goes:
[Environment]
Windows 7 Premium 64bit
IIS 7.0
PHP 5.3.3 VC9 Nonthread safe ZIP
mysql 5
[Description of the Problem]
Installed PHP to C:\PHP
When no defined "PHP.ini" is set in the C:\PHP folder, Firefox / IE, is able to load PHP files and display PHP exceptions fine.
this is displayed when view phpinfo();
Configuration File (php.ini)
Path C:\Windows
Loaded Configuration File (none)
When I modified the PHP.ini-development to PHP.ini -- this is where the problem is.
IE 7, 8 displays PHP exceptions just fine
Firefox displays PHP pages, but not the exceptions... Where there is an exceptions, it just displays blank page or does not load the page at all.
it just looks like the browser is refreshing.
this is what phpinfo(); displays:
Configuration File (php.ini) Path C:\Windows
Loaded Configuration File C:\PHP\php.ini
So to reiterate, with PHP.ini loaded, Firefox is not displaying any errors generated by PHP (exceptions and not user generated errors)
I've googled and only found one post about this with no solution or any leads to go on.
https://bugs.launchpad.net/ubuntu/+source/firefox-3.0/+bug/244432
attached is my php.ini file if that matters
as well as IE8 screen and FF screen. (FF screen is blank which is the problem)
[sorry can't post links since i am new]
thanks in advance.
[update 11/30 # 19:31 ET]
#Viper_SB, you're correct. After taking your suggestion of download HTTP headers, the following is captured:
GET /admin/phperror.php HTTP/1.1
Host: localhost:801
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 FirePHP/0.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
x-insight: activate
HTTP/1.1 500 Internal Server Error
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Wed, 01 Dec 2010 00:33:36 GMT
Content-Length: 129
But still, nothing is displayed:
I'm going to assume here that you DO have error_reporting enabled and setup correctly in php.ini.
Do you have the FF extension Live HTTP headers? If not install it and open the window, then run the page that doesn't work. Check the headers does it say:
HTTP/1.1 500 Server Error
If so your browser (or some other application) could be hiding the real the problem because it's saying it's an error. A lot of times browsers will try to display a friendly error to you if there is a 500 error (or 404 etc...)
The new AVG toolbar WILL cause this problem, but it'd do it in IE and in FF.