PHP isset not detecting url injection if it has a forward slash
Ok so I have the following issue that has cropped up recently.
In my adwords campaigns I inject ID's into my urls so I know how to funnel certain users. That is done by making my urls look like the following:
https://www.somesite.com/subdir/?identify=NEWID
Then PHP does the following to set a cookie.
if (isset($_GET['identify'])) {
setcookie('identify_cookie', $_GET['identify'], time() + 86400, "/");
}
Pretty basic stuff. Has worked for years untouched until recently.
For some reason this stopped working about a week ago and I filigreed out it was down to the forward slash.
So for instance if I use:
https://www.somesite.com/subdir?identify=NEWID
isset picks it up and sets the cookie. But with the forward slash it doesn't.
The issue I have is I can;t simply just drop the forward slash from all my urls as adwords just throws this in automatically always has done.
So there must be a server reason as to why this is happening or maybe a php reason.
Currently I'm using nginx proxy via Apache on PHP version 7.2.12 FPM served over Apache
php apache nginx plesk
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
add a comment |
Ok so I have the following issue that has cropped up recently.
In my adwords campaigns I inject ID's into my urls so I know how to funnel certain users. That is done by making my urls look like the following:
https://www.somesite.com/subdir/?identify=NEWID
Then PHP does the following to set a cookie.
if (isset($_GET['identify'])) {
setcookie('identify_cookie', $_GET['identify'], time() + 86400, "/");
}
Pretty basic stuff. Has worked for years untouched until recently.
For some reason this stopped working about a week ago and I filigreed out it was down to the forward slash.
So for instance if I use:
https://www.somesite.com/subdir?identify=NEWID
isset picks it up and sets the cookie. But with the forward slash it doesn't.
The issue I have is I can;t simply just drop the forward slash from all my urls as adwords just throws this in automatically always has done.
So there must be a server reason as to why this is happening or maybe a php reason.
Currently I'm using nginx proxy via Apache on PHP version 7.2.12 FPM served over Apache
php apache nginx plesk
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
What redirects /subdir to your php script ? I would start investigations from that point
– Alex Kapustin
Nov 21 '18 at 10:48
@AlexKapustin Can you elaborate on this a bit?
– DCdaz
Nov 21 '18 at 10:51
you are using apache, so I would check .htaccess file in either document root or subdir folder. I guess there is RewriteRule or it's in Apache config itself
– Alex Kapustin
Nov 21 '18 at 10:59
@AlexKapustin Can confirm not htaccess related
– DCdaz
Nov 21 '18 at 11:42
add a comment |
Ok so I have the following issue that has cropped up recently.
In my adwords campaigns I inject ID's into my urls so I know how to funnel certain users. That is done by making my urls look like the following:
https://www.somesite.com/subdir/?identify=NEWID
Then PHP does the following to set a cookie.
if (isset($_GET['identify'])) {
setcookie('identify_cookie', $_GET['identify'], time() + 86400, "/");
}
Pretty basic stuff. Has worked for years untouched until recently.
For some reason this stopped working about a week ago and I filigreed out it was down to the forward slash.
So for instance if I use:
https://www.somesite.com/subdir?identify=NEWID
isset picks it up and sets the cookie. But with the forward slash it doesn't.
The issue I have is I can;t simply just drop the forward slash from all my urls as adwords just throws this in automatically always has done.
So there must be a server reason as to why this is happening or maybe a php reason.
Currently I'm using nginx proxy via Apache on PHP version 7.2.12 FPM served over Apache
php apache nginx plesk
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
Ok so I have the following issue that has cropped up recently.
In my adwords campaigns I inject ID's into my urls so I know how to funnel certain users. That is done by making my urls look like the following:
https://www.somesite.com/subdir/?identify=NEWID
Then PHP does the following to set a cookie.
if (isset($_GET['identify'])) {
setcookie('identify_cookie', $_GET['identify'], time() + 86400, "/");
}
Pretty basic stuff. Has worked for years untouched until recently.
For some reason this stopped working about a week ago and I filigreed out it was down to the forward slash.
So for instance if I use:
https://www.somesite.com/subdir?identify=NEWID
isset picks it up and sets the cookie. But with the forward slash it doesn't.
The issue I have is I can;t simply just drop the forward slash from all my urls as adwords just throws this in automatically always has done.
So there must be a server reason as to why this is happening or maybe a php reason.
Currently I'm using nginx proxy via Apache on PHP version 7.2.12 FPM served over Apache
php apache nginx plesk
php apache nginx plesk
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
edited Nov 21 '18 at 10:28
DCdaz
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
asked Nov 21 '18 at 10:21
DCdazDCdaz
1,9731527
1,9731527
What redirects /subdir to your php script ? I would start investigations from that point
– Alex Kapustin
Nov 21 '18 at 10:48
@AlexKapustin Can you elaborate on this a bit?
– DCdaz
Nov 21 '18 at 10:51
you are using apache, so I would check .htaccess file in either document root or subdir folder. I guess there is RewriteRule or it's in Apache config itself
– Alex Kapustin
Nov 21 '18 at 10:59
@AlexKapustin Can confirm not htaccess related
– DCdaz
Nov 21 '18 at 11:42
add a comment |
What redirects /subdir to your php script ? I would start investigations from that point
– Alex Kapustin
Nov 21 '18 at 10:48
@AlexKapustin Can you elaborate on this a bit?
– DCdaz
Nov 21 '18 at 10:51
you are using apache, so I would check .htaccess file in either document root or subdir folder. I guess there is RewriteRule or it's in Apache config itself
– Alex Kapustin
Nov 21 '18 at 10:59
@AlexKapustin Can confirm not htaccess related
– DCdaz
Nov 21 '18 at 11:42
What redirects /subdir to your php script ? I would start investigations from that point
– Alex Kapustin
Nov 21 '18 at 10:48
What redirects /subdir to your php script ? I would start investigations from that point
– Alex Kapustin
Nov 21 '18 at 10:48
@AlexKapustin Can you elaborate on this a bit?
– DCdaz
Nov 21 '18 at 10:51
@AlexKapustin Can you elaborate on this a bit?
– DCdaz
Nov 21 '18 at 10:51
you are using apache, so I would check .htaccess file in either document root or subdir folder. I guess there is RewriteRule or it's in Apache config itself
– Alex Kapustin
Nov 21 '18 at 10:59
you are using apache, so I would check .htaccess file in either document root or subdir folder. I guess there is RewriteRule or it's in Apache config itself
– Alex Kapustin
Nov 21 '18 at 10:59
@AlexKapustin Can confirm not htaccess related
– DCdaz
Nov 21 '18 at 11:42
@AlexKapustin Can confirm not htaccess related
– DCdaz
Nov 21 '18 at 11:42
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53409902%2fphp-isset-not-detecting-url-injection-if-it-has-a-forward-slash%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53409902%2fphp-isset-not-detecting-url-injection-if-it-has-a-forward-slash%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What redirects /subdir to your php script ? I would start investigations from that point
– Alex Kapustin
Nov 21 '18 at 10:48
@AlexKapustin Can you elaborate on this a bit?
– DCdaz
Nov 21 '18 at 10:51
you are using apache, so I would check .htaccess file in either document root or subdir folder. I guess there is RewriteRule or it's in Apache config itself
– Alex Kapustin
Nov 21 '18 at 10:59
@AlexKapustin Can confirm not htaccess related
– DCdaz
Nov 21 '18 at 11:42