calling included remote functions

[juglesh]

at one centraldomain.com, I have central.php, which consists of this:
<?php
function square($num)
{ return $num * $num;
}
?>

at outerdomain.com, I have test.php, which consists of this:
<?php
include "http://www.centraldomain.com/central.php";
echo square(4); // outputs '16'.
?>

outerdomain.com/test.php =
"Fatal error: Call to undefined function: square() in blah/blah/test.php on
line 12"

wha'appen'? I thought you could call included functions? Hmm... if I put
central.php on the outerdomain.com, it works. No calling functions from
files included remotely?

--
juglesh

[Geoff Berrow]

I noticed that Message-ID: <Ur********************@comcast.com> from
juglesh contained the following:

No calling functions from
files included remotely?

Absolutely! Think about it.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Derek Fountain]

juglesh wrote:

wha'appen'? I thought you could call included functions? Hmm... if I put
central.php on the outerdomain.com, it works. No calling functions from
files included remotely?

Think about what's happening. The local server goes to the remote server and
asks for a file with a PHP suffix. The remote server reads the file off the
disk and, because it's a PHP file, executes it. It then delivers to the
local server the result of that execution, exactly as if the file had been
requested by a browser. What result is your central.php file going to
provide when executed? An empty string I think. Not what you want...

--
The email address used to post is a spam pit. Contact me at
http://www.derekfountain.org : <a
href="http://www.derekfountain.org/">Derek Fountain</a>

[Oli Filth]

There's a thread from a while ago that was about this.

http://groups-beta.google.com/group/...c848c4e9417f5/

--
Oli

[Robin]

juglesh wrote:

No calling functions from files included remotely?

If the local server could include a remote php file as the original php
rather than the interpreted php (usually html) then anyone could:

<?php
include('http://www.somedomain.com/db.php');

foreach ($GLOBALS as $k=>$v) { echo "$k => $v"; }
?>

and most likely discover somedomains sql username and password.

More over, if the php service on one server could request a copy of the
code from another, everybody's code would be public.

Robin

[Rushi]

It would be fun if something like this happened :) We would have a lot
of "semi-script kiddies"...
Robin wrote:

juglesh wrote:

No calling functions from files included remotely?
If the local server could include a remote php file as the original

php rather than the interpreted php (usually html) then anyone could:

<?php
include('http://www.somedomain.com/db.php');

foreach ($GLOBALS as $k=>$v) { echo "$k => $v"; }
?>

and most likely discover somedomains sql username and password.

More over, if the php service on one server could request a copy of the code from another, everybody's code would be public.

Robin

[juglesh]

"Oli Filth" <ca***@olifilth.co.uk> wrote in message
news:11**********************@g14g2000cwa.googlegr oups.com...

There's a thread from a while ago that was about this.

http://groups-beta.google.com/group/...c848c4e9417f5/

hrmm... Well, before I go trying the stuff in that link, let me tell you
what my big plan is.

I have a script that I would like to deploy over several websites. And
if/when I want to tweak the code, I don't want to have to go updating all
the sites. The scripts in question must be run on the 'satellite' sites
(unless of course I want everybody's picture galleries displaying *my* trip
to Disneyland!)

So, how would you go about this? I guess in this circumstance, I could
dream up a way to do it with dreamweaver templates...

oh, ps, I tried including a .inc file like on that thread above, and that
wasn't working either. can you do like getfilecontents, and then spit it
out for php to process? over remote sites(probly not, eh). But that was
early this morning, pre-coffee.

--
thanks, juglesh

[Geoff Berrow]

I noticed that Message-ID: <ia********************@comcast.com> from
juglesh contained the following:

I have a script that I would like to deploy over several websites. And
if/when I want to tweak the code, I don't want to have to go updating all
the sites. The scripts in question must be run on the 'satellite' sites
(unless of course I want everybody's picture galleries displaying *my* trip
to Disneyland!)

Remember
input->process->output.

In other words you send information to the processing script (e.g.
location of photo directory, number of photos to display or it could
handle database queries). This script then takes that information and
processes it creating and outputting the html necessary to create the
viewing page. If the photo links were absolute there is no reason why
pone script could not serve any number of sites. Security may be an
issue to avoid the script being used by unauthorised users.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[juglesh]

"Geoff Berrow" <[e-mail]> wrote in message
news:0s********************************@4ax.com...

I noticed that Message-ID: <ia********************@comcast.com> from
juglesh contained the following:

I have a script that I would like to deploy over several websites. And
if/when I want to tweak the code, I don't want to have to go updating all
the sites. The scripts in question must be run on the 'satellite' sites
(unless of course I want everybody's picture galleries displaying *my*
trip
to Disneyland!)

Remember
input->process->output.

In other words you send information to the processing script (e.g.
location of photo directory, number of photos to display or it could
handle database queries). This script then takes that information and
processes it creating and outputting the html necessary to create the
viewing page. If the photo links were absolute there is no reason why
pone script could not serve any number of sites. Security may be an
issue to avoid the script being used by unauthorised users.

the script that will run on the central domain needs to do several readirs,
is_files, etc. Testing with is_file is not working.

satellite domain:
test.php=
include "http://www.centraldomain.com/central.php";

central domain:
central.php=
if
(is_file("http://www.satelitedomain.com/aFileThatExists.php")){
echo "file read";
}else{echo "not read";}

output of satelitedomain.com/test.php= not read

something about
http://us4.php.net/manual/en/functio...r-register.php ?

--
thanks for your time
juglesh

[Geoff Berrow]

I noticed that Message-ID: <3O********************@comcast.com> from
juglesh contained the following:

the script that will run on the central domain needs to do several readirs,
is_files, etc. Testing with is_file is not working.

From the manual on include:

If "URL fopen wrappers" are enabled in PHP (which they are in the
default configuration), you can specify the file to be included using a
URL (via HTTP or other supported wrapper - see Appendix L for a list of
protocols) instead of a local pathname. If the target server interprets
the target file as PHP code, variables may be passed to the included
file using a URL request string as used with HTTP GET. This is not
strictly speaking the same thing as including the file and having it
inherit the parent file's variable scope; the script is actually being
run on the remote server and the result is then being included into the
local script.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[juglesh]

"Geoff Berrow" <[e-mail]> wrote in message
news:75********************************@4ax.com...

I noticed that Message-ID: <3O********************@comcast.com> from
juglesh contained the following:

the script that will run on the central domain needs to do several
readirs,
is_files, etc. Testing with is_file is not working.

From the manual on include:

If "URL fopen wrappers" are enabled in PHP (which they are in the
default configuration), you can specify the file to be included using a
URL (via HTTP or other supported wrapper - see Appendix L for a list of
protocols) instead of a local pathname. If the target server interprets
the target file as PHP code, variables may be passed to the included
file using a URL request string as used with HTTP GET. This is not
strictly speaking the same thing as including the file and having it
inherit the parent file's variable scope; the script is actually being
run on the remote server and the result is then being included into the
local script.

I'm running this on the remote(central) server:
if (is_file("http://www.satelitedomain.com/aFileThatExists.php")){
echo "file read";}

so, why is that IF not true? Well, security, I suppose? The script not
allowed to
know what file exists on another server? Oh, doesn't work to use the
absolute url from the local computer, either. No is_file from http, then.
Probly no readdir either?

I might have to go back to the idea of using .inc files, but I think my
server is weird about them. If I include a .inc nothing happens, if I
include a .xyz it works fine (but exhibits the above behavior).

--
juglesh

[J.O. Aho]

juglesh wrote:

I'm running this on the remote(central) server:
if (is_file("http://www.satelitedomain.com/aFileThatExists.php")){
echo "file read";}
The 'http://www.satelitedomain.com/aFileThatExists.php' ain't really a file in
this example, but a stream. is_file() you use on your local filesystem.

No is_file from http, then. Probly no readdir either?
readdir(), if it works, I don't know as I haven't tried that, the result is
depending on the remote server settings, if it's allowed to directory list or
not, at least I don't allow that. As the data from a remote server (over http)
isn't files but streams, so there is a quite high risk that the operation will
fail.

I might have to go back to the idea of using .inc files, but I think my
server is weird about them. If I include a .inc nothing happens, if I
include a .xyz it works fine (but exhibits the above behavior).

Blocking to serve *.inc is a good way to do on a server, as in most cases a
*.inc file would be unprocessed and would be quite a good catch fro people who
wants to ruin something when they read config.inc and see your login and
password for the sql database, I know that some have named their *.inc to
*.inc.php so that the page will be processed and generate a blank page when
remotly read.

If you want to use remote files, then you don't have any other option than
using a none standard extention on the files, so that you wont get the
processed page, but this does mean that other people can read your code and
use the information they find in the files to try to make some harm.
//Aho