Cron Job - Recursively replace file instance with master file (timthumb exploit prevention) - php

I'm trying to figure out a cron job which will copy a file (timthumb.php) from the root of ftp (above our public_html directory) and recursively replace all existing instances of the file throughout the FTP. I'm also open to other ideas if someone has another method for doing this.
The master file would live at:
/timthumb.php
A cron would run daily to replace instances such as:
/public_html/wp-content/themes/xxxxxx/scripts/timthumb.php
or
/public_html/mysite1/tools/timthumb.php
(We're assuming the instance will always be named timthumb.php, so there's no need to look into the content of the file to match code)
The goal of this cron is to prevent old instances of timthumb from existing on our server.
Any help or ideas would be greatly appreciated
Thanks
-Sam
PS You can read about the timthumb exploit here:
http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/

This would do it:
0 0 * * * find /path/to/ftp-root -iname timthumb.php -exec cp /path/to/good-timthumb.php {} \;

Related

Create a folder in the /root directory

I've tried everything online but I couldn't find a real solution, I have a php file that in local on my computer works perfectly, instead when I load it on my seerver it doesn't create the folder.
the php contains this string to create a new folder:
shell_exec("mkdir /root/users/$username");
I guess that maybe it's a problem of permission, I can just create folders in the var/www folder, dI tried a lot of different way to set my permission but I can't figure it out.
You should use mkdir to create folder or chmod to change permissions functions.
for example:
mkdir('newFolder', 775);
or you want to create on some path. Currently you are in /home/username/public_html/project/
mkdir('subproject', 775); // it will create in `project` folder.
if you want to create with some root like you asked in your question.
mkdir('/root/users/'.$username, 775);
I am sure it will be fix your issue and also a standard way to create.

PHP renaming index files

I'm trying to switch index files using PHP and have gone for a method where I rename respective index files, like this:
<?php
rename("/index.html", "/REALindex.html");
rename("/index2.html","index.html");
?>
The PHP script is located in a folder child of the index files, but when I run this php nothing happens to the files, so I am both wondering how I'm supposed to debug and also why it's not working..?
Thanks a lot.
If your PHP script has permissions to edit the local directories you're running in (based upon the comment you made), your HTML files are one level up from the php, so try:
rename("../index.html", "../REALindex.html");
rename("../index2.html","../index.html");
Note the forward slash at the beginning of the paths. Could it be that this is accidentally and you're unwillingly trying to move files from/to the filesystem root, where they just aren't?
SOULTION:
chmod -R 777 /var/www/html
+
rename("../index.html", "../REALindex.html");
rename("../index2.html","../index.html");

Resizing batch of images with with yiic cronjob

I have this problem, I want to execute a cronjob but when I run the cron manually for testing I get permission issues.
I am using the Yii framework and I call the cronjob using Yiic. I want to create a directory structure where every directory contains an image. So we get like this:
/dir/id/
/dir/id/imgsize-1
/dir/id/imgsize-2
/dir/id/imgsize-3
It get's more complex because it could be that imgsize-3 exists while imgsize-1 doesn't. And it could be possible that /dir/id/ is not writeable (0755 perms) so I first need to check if the parent directory (/dir/id/) is writable. If so I should be able to use mkdir to create dir 'imgsize-1' or whatever is my thought so far.
But now the problem occurs that if I want to use chmod to make a the parentdirectory writable I get the error 'chmod: 'path/to/dir' operation not permitted' and after that ofcourse that mkdir results in 'Permission denied'.
How can I solve this. When I use ls -la on the specific directorie I want to make writable I get the following:
4 drwxr-xr-x 9 nobody nobody
Is there someone who can help me with this?
b.t.w. I execute the CLI-commands in PHP with shell_exec.
Kind regards,
Pim
in your command action you should have something like this:
$dir = '/your/path';
if (!is_dir($dir))
mkdir($dir, 0777, true);
Then, running the cron (what's the user you're running the command with?) with the command php yiic yourCommand, the directory should be created in /your/path

system("cp /1.txt /2.txt", $out); just doesn't work?

I'm trying to work with php system (exec) functions to run some commands on linux, but it just doesn't work!
I've logged into the system with root user. I created "/1.txt" file and then I ran this php script through apache server: system("sudo cp /1.txt /2.txt", $out); but it doesn't copy the file.
Can you explain why it doesn't work? (I'm new to linux os please explain)
Drop the sudo and give permissions to apache's user on /1.txt and /2.txt, it should work.
If /2.txt doesn't exist, create a directory, put 1.txt on that directory and give permissions to apache user both on the directory and on the file.
/1.txt and /2.txt are at the very top level of the filesystem - is that what you're aiming to do? Either way it's not a good idea.
I'd recommend having an area which your files are in, for example /var/webapp-files/ that way you can do something like:
define('WEBAPP_FILES_LOCATION', '/var/webapp-files');
system("cp ".WEBAPP_FILES_LOCATION."/1.txt ".WEBAPP_FILES_LOCATION."/2.txt", $out);
NOTE: I've defined a constant for the location because it'll be needed in a number of different places and you don't wanna start repeating yourself in case you want to change it any time.
What this'll do is run the system command:
cp /var/webapp-files/1.txt /var/webapp-files/2.txt
Which should succeed if your /var/webapp-files directory has write access for your apache user.
However... PHP does have a built-in function for copying which I'd recommend using instead of the more generic and dangerous system(). You can read about copy() at http://uk3.php.net/manual/en/function.copy.php This will need the full paths as cp does so you can refactor my previous example to:
define('WEBAPP_FILES_LOCATION', '/var/webapp-files');
$copySucceeded = copy(WEBAPP_FILES_LOCATION."/1.txt", WEBAPP_FILES_LOCATION."/2.txt");
echo "The copy attempt ". ($copySucceeded ? "succeeded" : "failed");
Hope that helps.

Best and fast way to list a local drive's root folders and files and the size of them in php?

E.g:
local drive C:
folder1 346MB
folder2 567MB
....
file1 345MB
file2 343MB
....
Because I have thousands of folder or files in the local drives , and I want it to display in the web page and remove them from the web page base on their total access times . and the folders or files which have no access will be deleted!So is it a good way to do that or have others much better!?
Any idea would help!!
[update]
I found a windows tool to Calculate folder size from the command line .Disk Usage v1.34. It is good to return all folder and their's size. And now the question:
Which is faster.PHP or the internal command line tool!?
Thank yo very much!!
Use a shell command.
Never tried this etc. But this is more of what you are looking for. As for the deletion an access times, you will have to code it up and figure out that logic.
http://pc.byethost17.com/scripts/php/?id=12

Categories