4 ms·
It depends by the command, echo is idempotent for example. There should be some checking like $cmdname = split(' ', $_GET['command']); if(!in_array(IDEMPOT
by izietto 13y ago
It depends by the command, echo is idempotent for example. There should be some checking like
$cmdname = split(' ', $_GET['command']);
if(!in_array(IDEMPOTENT_COMMANDS, $cmdname))
echo '<h1>Your request is not guaranteed to be idempotent. Please use a POST.</h1>';
else
exec($_GET['command'] ...
- TeMPOraL 13y agoif(!in_array(IDEMPOTENT_COMMANDS, $cmdname)) { header("HTTP/1.1 405 Method Not Allowed"); die(); } Fixed ;).
- dspillett 13y agoecho is idempotent As a simple call, yes. But there are many shell tricks (redirection, command substitution, process substitution) that can make an echo call have significant side effects - so if you were daft enough to be considering this you'd need to do much more checking before submitting the provided instruction to your shell, and those checks would need to know which shell you were targeting (in fact you'd probably want to force the issue by exec()ing a specific shell instead of just using the default for the user the code is running as).
- izietto 13y agoYes, though if a shell is chosen and the command is shell escaped you are good to go