PHP - Prevent client from tampering the ID of a form

问题

How to fix the security flow of this code:

 <a href="http://localhost/mypay/admin/company/#" 
   data-pk="26" data-url="http://localhost/mypay/admin/company/update/profile" 
   id="name" 
   name="name" 
   data-type="text" 
   data-source="">dfg</a>

This uses x-editable [bootstrap] - http://vitalets.github.io/x-editable/

I am just curious how to improve my security for my application if ever the client changes the "PK" primary key of the data. Where should the ID must be placed or what other security measures I would create to prevent them in doing it?

I use: Bootstrap and Codeigniter.

回答1:

You'll have to check on the server side if the current user is allowed to edit this entry. Do not try to secure the client side, it is impossible. People will always be able to edit data on their computer, it is your responsibility to control it when it arrives at a place you control.

回答2:

We, PHP coders, don't always see that weakness in our code. We do a big fuss about identifying the users (pw, sessions, etc.) and we clean up the code to prevent SQL injection of all sort. OK ! But what if a perfectly identified user, who is legitimate to update HIS OWN record (say he's ID 24) just send back his update form to your app with all empty fields and ID=23, then ID=22, etc. One could easily wipe out all your records in a few minutes (even faster with a little loop: for(id=1, id < 10000, etc.)

So, very good question INDEED !

Here is my solution (certainly not the best one):

When an identified user click on a button to edit HIS record, I do this:

I read his record (SELECT) to get the data.
I UPDATE that record putting two temporary informations in it: a timestamp and a random string (a 35 characters long string, like an MD5 but randomly created).
Then I send to that user an edit form with all data, including a hidden field {name="id" value="24"} and another hidden field {name"UpdatableOnlyBy" value="ks3kms36di7eur94k3n..."}
Whenever a form comes back by $_POST[] to update a record, say this #24, I accept to do it ONLY IF the {UpdatableOnlyBy} string equals the one temporarily stored in that record AND if the timestamp is not older than 20 minutes. Then, and only then, I do the UPDATE (which by the way sets that special {UpdatableOnlyBy} field back to Null).

Any data coming in FOR ANOTHER ID will not lead to any UPDATE, because the records aimed at do not have the same random {UpdatableOnlyBy} string.

I leave up to you to decide when and how to clean those two fields, if they are left with old MD5-strings and timestamps. For my part, I have a cronjob at 0h25 that clears all those fields for yesterday and before. But in the past, I have kept those data to see how many records pulled for being updated where left "orphans" (edit forms who never came back...). In one of my app, it was less than 6 %.

来源：https://stackoverflow.com/questions/18167085/php-prevent-client-from-tampering-the-id-of-a-form

标签

php

security

codeigniter

twitter-bootstrap

x-editable