我可以混淆PHP函数调用

Question

I have a JavaScript function like this:

function delPhoto(thisPhotoID) {
  $("#php").load("delphoto.php?id=" + thisPhotoID);
}

This PHP function deletes the appropriate photo from a MySQL database, however anyone who looks at the source for the webpage could maliciously call the delphoto.php script with any number and delete random photos from the database.

Is there a way that I can obfuscate this function call so that this can't be done, or is there a way for the PHP function to refuse calls made to it from outside of the webpage?

Answer 1

I am wondering if I can implement some kind of checksum such that delphoto.php would know that it was a valid call,

Eg:

delphoto.php?id=13&checksum=A4F8W9

where 13 equates to A4F8W9 and without the correct checksum it wouldn't be a valid call? So if someone wanted to try to delete image #14 they would need to figure out how to compute the correct checksum.

Answer 2

Security Issue 1:
Never expose your back-end in this way : build a contoller; Front-end must communicate only with controller, so all of your PHP scripts will be hidden for users

Security Issue 2:
Use the system of token for this kind of operations

1- Generate a random number, ex: using uniqid() , store it in list or associative array (User, Token) and push it in Memcached , ANYEM or Redis Data Server
2- Generate your Link :

"controller?action=delete&imageId=" . $photoID . "&token=" . $tokenId";

3- When method DELETE is executed, verify the received $tokenId , if action is allowed, delete the stored Token from Data Server (it must be used only once)

Answer 3

however anyone who looks at the source for the webpage could maliciously call the delphoto.php script with any number and delete random photos from the database.

If I wanted to screw with your website, or even if I was just curious and poking around, having numeric ID's for your photos available to the world is a great place to start. Especially with something like "delphoto". If I wanted to place load on your server as well as mess with you in general, I would setup a script to hammer every single ID I could in parallel. Not only would this cause massive headaches for the user from data loss, but depending on if this call is deleting the photo from disk it could tie up server resources as well.

Is there a way that I can obfuscate this function call so that this can't be done, or is there a way for the PHP function to refuse calls made to it from outside of the webpage?

It's good that you're conscious enough to understand that what you have currently is not secure. But obfuscation is no replacement for actual security. Any administrative function on a website should be secured by both a user system, and by a role management scheme. There should be a clear cut difference between a user and an admin as far as who can do what on a site.

I don't know if you're using a framework, but obviously we can't tell you how to secure the endpoint without seeing any code on how your user system works. But if you have one you need to look into the documentation and determine how to check if a user is:

1. Logged in
2. Has permission to run the action

Depending on what your system does, this might need to change. For example, an admin should be able to delete anything. But a user should only be able to delete their own photos. So part of the "permission to run the action" would have an ownership check.