Coppermine Photo Gallery v1.5.x: Documentation and Manual

Sanitization of Superglobals using Inspekt

Target audience

This part of the documentation is not meant for end users of Coppermine, but only for developers and skilled users who are familiar with coding. There is no support for this section, it comes as-is.

For coppermine dev team members, this piece of documentation is meant both as a reference as well as a programming guideline.

For users, this section can be helpful if you want to modify your coppermine gallery and want to come up with additional functionality and use superglobals (like $_GET and $_POST variables) in those custom scripts.

What's new?

Starting with cpg1.5.0 the individual components of coppermine (the script files like displayimage.php) can no longer access superglobals like $_GET or $_POST directly. Those superglobals are being put into a "cage" object instead when the Coppermine basic includes get started and all vars and function are being initialized. Once the "cage" has been populated, the superglobals get emptied and can therefore no longer be accessed. Subsequently, you can no longer use the superglobals as you might be used to. Confused? Read on.

Reason

Everyone knows that you should filter your inputs - most of the good programmers do it, but when you are working with a large team of programmers on an open source project things slip up, errors do creep in, at times like this you wish for a mechanism which would prevent your team from making such mistakes, some thing which forces them to declare their intent.

Most of the vulnerabilities that have been discovered in cpg1.4.x where caused by user input not properly sanitized, which led to XSS attacks becoming possible. In an effort to improve the security behind coppermine thoroughly the dev team has decided to sanitize all superglobals using the tool "Inspekt" (which is being released under the BSD license and can therefore be included without issues into the coppermine core code license-wise).

The idea to use Inspekt has been brought up by Coppermine lead developer Dr. Tarique Sani in his blog article "Inspekt - put a firewall in your PHP applications", where he discusses the reasons to use Inspekt in detail.

What Inspekt does

Inspekt acts as a sort of 'firewall' API between user input and the rest of the application. It takes PHP superglobal arrays, encapsulates their data in an "cage" object, and destroys the original superglobal. Data can then be retrieved from the input data object using a variety of accessor methods that apply filtering, or the data can be checked against validation methods. Raw data can only be accessed via a getRaw() method, forcing the developer to show clear intent. Read more about usage on the Inspect Wiki: Basic Usage.

How to use Inspekt with Coppermine Photo Gallery

Inspekt provides tools for filtering scalar or array data in two ways:

• Cage objects that encapsulate an array and provide accessor methods that force filtering and/or validation - Special helper methods allow you to set up cages on the input superglobals with one method call
• Static filters and validators for arbitrary scalar or array data

The guiding principle for Inspekt is to make it easier to create secure PHP applications. As such, ease of use is valued over flexibility, and verbosity is avoided when possible.

// Example: creating a cage for $_POST
require_once "Inspekt.php";

$cage_POST = Inspekt::makePostCage();

$userid = $cage_POST->getInt('userid');

if ( !isset($_POST['userid']) ) {
    echo 'Cannot access input via $_POST -- use the cage object';
}

set_include_path(get_include_path().PATH_SEPARATOR.dirname(__FILE__).PATH_SEPARATOR.'Inspekt');
echo dirname(__FILE__);
require_once "Inspekt.php";

$superCage = Inspekt::makeSuperCage();

$qs = $superCage->server->getDigits('QUERY_STRING');
$album_id = $superCage->get->getInt('album');
$title = $superCage->post->getAlpha('title');

$CLEAN['cat'] = isset($_GET['cat']) ? (int)($_GET['cat']) : 0;

$cat = $CLEAN['cat'];

if ($superCage->get->keyExists('cat')) {
    $cat = $superCage->get->getInt('cat');
} else {
        $cat = 0;
}

if ($_REQUEST['action'] == 'browsebydate') {

$month = (int) $_REQUEST['month'];
$year  = (int) $_REQUEST['year'];

if ($matches = $superCage->get->getMatched('action', '/^[a-z]+$/')) {
    $action = $matches[0];
} elseif ($matches = $superCage->post->getMatched('action', '/^[a-z]+$/')) {
    $action = $matches[0];
} else {
    $action = '';
}
if ($action == 'browsebydate') {

if ($superCage->get->testInt('month')) {
        $month = $superCage->get->getInt('month');
} elseif ($superCage->post->testInt('month')) {
    $month = $superCage->post->getInt('month');
} else {
        $month = 0;
}

if ($superCage->get->testInt('year')) {
    $year = $superCage->get->getInt('year');
} elseif ($superCage->post->testInt('year')) {
    $year = $superCage->post->getInt('year');
} else {
    $year = 0;
}

if (isset($_GET['get'])) {
     $file_index = (int)$_GET['get'];

<img src="images/folder.gif" alt="">&nbsp;<a href="{$_SERVER['PHP_SELF']}?get=$index">$file</a>

if ($superCage->get->keyExists('get')) {
                $file_index = $superCage->get->getInt('get') ;

<img src="images/folder.gif" alt="">&nbsp;<a href="{$CPG_PHP_SELF}?get=$index">$file</a>

Links

• Inspekt project pages
  
  • Inspekt Wiki: BasicUsage
  • BSD license
  • Download Inspekt
  • Zend Framework
  • Inspekt svn
• PHP documentation: superglobals
• Blog article "Inspekt - put a firewall in your PHP applications" by Dr. Tarique Sani
• Coppermine board: Inspekt introduction progress (access restricted to dev team members)
• Coppermine board: Getting started with Inspekt for CPG (access restricted to dev team members)