Secure PHP Development- P124 pdf

It works as follows:◆ It gets a list of IP addresses or host names from the command line using the getHostListfunction.. Here are some example runs of this script: $ ./geolocator.php www

This script requires the netgeo.phpclass It works as follows:

◆ It gets a list of IP addresses or host names from the command line using the getHostList()function.

◆ For each given IP or host name, it performs netgeo lookup using

findLocation(), which prints the geographic data available for the given

IP or host name Note that not all IP addresses or host names are in the netgeo database, so a result might not always be available.

Here are some example runs of this script:

$ /geolocator.php www.yahoo.com www.yahoo.com: Approximate location:

City : SUNNYVALE State :CALIFORNIA Country :US

Longitude:122degree West Latitude:37.4degree North

-You can see that www.yahoo.com appears to be located in Sunnyvale, CA, U.S Following is another example:

$./geolocator.php www.amazon.com www.amazon.com:Approximate location:

City : SEATTLE State :WASHINGTON Country :US

Longitude:122.31degree West Latitude:47.55degree North

-In the preceding example, you can see that www.amazon.com appears to be located in Seattle, Washington, U.S

One last example:

$./geolocator.php www.csus.edu www.csus.edu: Approximate location:

City : SACRAMENTO State :CALIFORNIA Country :US

Longitude:121.44degree West Latitude:38.57degree North

-You can see www.csus.com (California State University, Sacramento) appears to

be located in Sacramento, CA, U.S., which makes sense

This script should be used from the command line as needed However, if you wish to make it available to everyone, you can install it in /usr/bin, which is typi-cally in any user’s path Here is how:

1 Make a directory called /usr/local/src/php/gelocatorand copy the

netgeo.phpclass into that directory Make sure the directory is r+xby all users In addition, make sure netgeo.phpis readable by all users, but nei-ther should be writable.

2 Copy geolocator.phpinto /usr/binas geolocator We remove the php extension because executable scripts typically do not need extensions.

3 Modify /usr/bin/geolocatorsuch that require_once(“netgeo.php”)

now is require_once(“/usr/local/src/php/geolocator/netgeo.php”) This will ensure that when users run geolocatorfrom the command line, the /usr/bin/geolocatorscript will find the netgeo.phpclass.

Now you and your users can run geolocatorfrom anywhere.

Note that the geolocator script is fairly accurate, but its output should not be used as a final (and perhaps critical) determination of a particular host’s location

Building a Hard Disk Usage Monitoring Utility

Now we will develop a hard disk usage monitoring tool that uses Linux proc file system information to determine hard disk usage, and if usage for a given mounted file system exceeds a specified percentage, the utility sends an e-mail message to the administrator.

The script we will develop here requires the classLinux.inc.php and com-mon_functions.php classes from the phpSysInfo project, which is located at

http://phpsysinfo.sourceforge.net/project.

Download the phpSysInfo project and you will find the common_

functions.php in the main distribution directory; the class.Linux

inc.phpcan be found in the os subdirectory within the includes directory

Listing 16-10 shows an example configuration file for this script.

Listing 16-10: hdmonitor.conf

<?php define(DEBUG, FALSE);

// Send email when mounted filesystem reaches // percentage or more as given here

$MAXSIZE[‘/’] = 30;

$MAXSIZE[‘/usr’] = 50;

$MAXSIZE[‘/mnt/win’] = 90;

$MAIL_TEMPLATE = ‘hdmonitor_mail.txt’;

?>

Defined in the $MAXSIZEarray are three mount points (partitions), which can be also written as follows:

$MAXSIZE = array ( ‘/’ => 30,

‘/usr’ => 50,

‘/mnt/win’ => 90 );

These three mount points will be monitored by the script when it is run daily via cron Whenever any of these mount points exceed the usage percentage stated here, the $MAIL_TEMPLATEfile is used to send mail to the e-mail addresses listed in this mail template Listing 16-11 shows the monitoring script called hdmonitor.php.

Listing 16-11: hdmonitor.php

#!/usr/bin/php -q

<?php require_once(‘hdmonitor.conf’);

require_once(‘class.Linux.inc.php’);

require_once(‘common_functions.php’);

$alertInfo = array();

$system = new sysinfo;

$alertInfo[‘/<%HOST%>/’] = $system->chostname();

$alertInfo[‘/<%IP_ADDR%>/’] = $system->ip_addr();

$alertInfo[‘/<%KERNEL%>/’] = $system->kernel();

$alertInfo[‘/<%TODAY%>/’] = date(‘M-d-Y h:i:s A’);

$diskInfo = getDiskInfo($system->filesystems());

$alert = 0;

foreach ($diskInfo as $mount => $currentPercent) {

if (!empty($MAXSIZE[$mount]) &&

$MAXSIZE[$mount] <= $currentPercent )

{

$alert++;

$alertInfo[‘/<%DISK_STATUS%>/’] =

“Filesystem: $mount exceeds limit “

“Currently used: $currentPercent%\n”;

if (DEBUG) echo “Filesystem: $mount exceeds limits.\n”;

} }

if ($alert) sendAlert($alertInfo);

exit;

function sendAlert($info = null) {

$lines = file($GLOBALS[‘MAIL_TEMPLATE’]);

$contentTypeSet = FALSE;

$message = array();

$headers = array();

foreach ($lines as $str) {

$index++;

if (preg_match(‘/To:\s*(.+)/i’,

$str, $match)) {

$to = $match[1];

} else if (preg_match(‘/From:\s*(.+)/i’,

$str, $match))

Continued

Listing 16-11(Continued)

{ array_push($headers, “From: $match[1] \r\n”); }

else if (preg_match(‘/Subject:\s*(.+)/i’,

$str, $match)) {

$subject = $match[1];

} else if (preg_match(‘/^CC:\s*(.+)/i’,

$str, $match)) {

array_push($headers, “Cc: $match[1] \r\n”); }

else if (preg_match(‘/Bcc:\s*(.+)/i’,

$str, $match)) {

array_push($headers, “Bcc: $match[1] \r\n”); }

else if (preg_match(‘/Content-Type:\s*(.+)/i’,

$str, $match)) {

if (preg_match(‘/html/’, $match[1])) {

array_push($headers,

“Content-Type: text/html\r\n”); } else {

array_push($headers,

“Content-Type: text/plain\n”); }

$contentTypeSet = TRUE;

} else if (preg_match(‘/MIME-Version:\s*(.+)/i’,

$str, $match)) {

array_push($headers,

“MIME-Version: $match[1] \r\n”); } else {

array_push($message, $str);

} }

if (! $contentTypeSet)