限制仅在服务器上执行Python文件（防止从浏览器访问）

Question

I have two Python files that I want to prevent anyone from executing unless it's from the server itself. The files implement a function that increases an amount of money to a user. What I need is to make this file not public to the web, so that if someone tries to call this file, the file would refuse this request, unless the call is from the server.

Does anyone know how I can do this? My first idea was to check for the IP address but a lot of people can spoof their IP.

Example

Let's say I have this file: function.py , a function in this file will accept a new amount of money and increase the appropriate balance in the database.

When someone tries to post data to this file, and this person is outside the server (lets say from 244.23.23.0 ) the file will be in-accessible. Whereas, calling the function from the server itself will be accepted.

So files can access other files on the server, but external users cannot, with the result that no one can execute this file unless it's called from the server.

This is really important to me, because it's related to real money. Also, the money will come from PayPal IPN. And actually, if there was a way to prevent access unless it was coming from PayPal, that would be an amazing way to secure the app.

OK, as far as what I have tried:

1. Put the database in a cloud SQL using Google [https://developers.google.com/cloud-sql/]
2. Try to check the IP of the incoming request, in the file

Thanks for any and all help.

Answer 1

If you use Apache, you could use .htaccess to limit access to your files:

http://httpd.apache.org/docs/current/howto/htaccess.html

Answer 2

.htaccess, chmod or you could use a key defined by yourself... You have several possibilies.

Edit: Anyway, if the file only contains a function. Nobody can use it from an external http request, unless you actually call it in this file: function();

Answer 3

In regards to PayPal..

I recommend taking a look at this example from paypal, they're part of x.com it's legit.

The important part is this:

// STEP 2: Post IPN data back to paypal to validate

$ch = curl_init('https://www.paypal.com/cgi-bin/webscr');
curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_FORBID_REUSE, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Connection: Close'));

// In wamp like environments that do not come bundled with root authority certificates,
// please download 'cacert.pem' from "http://curl.haxx.se/docs/caextract.html" and set the directory path 
// of the certificate as shown below.
// curl_setopt($ch, CURLOPT_CAINFO, dirname(__FILE__) . '/cacert.pem');
if( !($res = curl_exec($ch)) ) {
    // error_log("Got " . curl_error($ch) . " when processing IPN data");
    curl_close($ch);
    exit;
}
curl_close($ch);


// STEP 3: Inspect IPN validation result and act accordingly

if (strcmp ($res, "VERIFIED") == 0) {
    // check whether the payment_status is Completed
    // check that txn_id has not been previously processed
    // check that receiver_email is your Primary PayPal email
    // check that payment_amount/payment_currency are correct
    // process payment

    // assign posted variables to local variables
    $item_name = $_POST['item_name'];
    $item_number = $_POST['item_number'];
    $payment_status = $_POST['payment_status'];
    $payment_amount = $_POST['mc_gross'];
    $payment_currency = $_POST['mc_currency'];
    $txn_id = $_POST['txn_id'];
    $receiver_email = $_POST['receiver_email'];
    $payer_email = $_POST['payer_email'];
} else if (strcmp ($res, "INVALID") == 0) {
    // log for manual investigation
}

What happens here is the request posted to your ipn script is sent back to paypal for validation, paypal checks the details and sends back a "valid" response, at this point you know the data is good and has been sent by paypal, you are then at a point where you can act on the data and update databases or whatever action you need to do.

Answer 4

you can try the following:

move it out of the public_html folder.

if (php_sapi_name() == 'cli')
{
   //code to be executed
}
else if (php_sapi_name() != 'cli')
{
   die();
}

This way the file will only be executed from command line and that too from your sever itself because you will have to authenticate server details. The file cannot be executed form web.

Answer 5

Another not very elegant way to do it could be defining a needed and secret parameter to be able to execute the code.

For example:

www.myweb.com/myfunction.php?pass=secretPassword

Then you could just check if the password is the one you expect with something like:

//hardcoded hashed pass with sha1, for example.
$myHashedPass = '40bd001563085fc35165329ea1ff5c5ecbdbbeef';

if(sha1($_GET['pass']) != $myHashedPass){
    die();
}

Might not be the best solution but combined with some others can be useful.