Re: Legacy PHP script
Jamie Holly <[email protected]> Sat, 31 Jan 2015 13:43:35 -0500
| Newsgroups | gmane.comp.php.drupal.support |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--===============1885479313351410683==
Content-Type: multipart/alternative;
boundary="------------000002090802010306070500"
This is a multi-part message in MIME format.
--------------000002090802010306070500
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Never, never, NEVER put script files inside of the files directory
system. Drupal puts mechanisms in to prevent the execution of those
files, through .htaccess. If you try to bypass that, it will complain.
Of course if you like seeing your site hacked and all your work
destroyed, you can just ignore those complaints.
Jamie Holly
http://hollyit.net
On 1/31/2015 12:23 PM, Chris Miller wrote:
> Hi Folks,
>
> I have a legacy php script that displays a form, accepts input and
> posts back to itself, where it looks for a non-zero $_POST array to
> decide if it is processing or displaying. In the event of process, it
> updates a database and redirects to a thank-you page. Simple.
>
> I put this script in /site/default/files/form.php and I href'd it to a
> picture. When I click the picture, I get the text of form.php, not the
> result of processing. I have discovered that if I put the form on a
> different website, then I do get execution, so apparently Drupal is
> able to suppress php execution within its URL space. How do I bypass
> anti-execution restriction for this legacy script? Or, how do I
> incorporate this legacy script into an existing Drupal site?
>
> Thanks for the help,
>
> Chris.
>
>
--------------000002090802010306070500
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Never, never, NEVER put script files
inside of the files directory system. Drupal puts mechanisms in to
prevent the execution of those files, through .htaccess. If you
try to bypass that, it will complain. Of course if you like seeing
your site hacked and all your work destroyed, you can just ignore
those complaints. <br>
<pre class="moz-signature" cols="72">Jamie Holly
<a class="moz-txt-link-freetext" href="http://hollyit.net">http://hollyit.net</a></pre>
On 1/31/2015 12:23 PM, Chris Miller wrote:<br>
</div>
<blockquote
cite="mid:[email protected]"
type="cite">
<div style="font-family: arial, helvetica, sans-serif; font-size:
10pt; color: #000000">
<div>Hi Folks,<br>
</div>
<div><br>
</div>
<div>I have a legacy php script that displays a form, accepts
input and posts back to itself, where it looks for a non-zero
$_POST array to decide if it is processing or displaying. In
the event of process, it updates a database and redirects to a
thank-you page. Simple.<br>
</div>
<div><br>
</div>
<div>I put this script in /site/default/files/form.php and I
href'd it to a picture. When I click the picture, I get the
text of form.php, not the result of processing. I have
discovered that if I put the form on a different website, then
I do get execution, so apparently Drupal is able to suppress
php execution within its URL space. How do I bypass
anti-execution restriction for this legacy script? Or, how do
I incorporate this legacy script into an existing Drupal site?<br>
</div>
<div><br>
</div>
<div>Thanks for the help,</div>
<div> <br>
</div>
<div><span name="x"></span>
<div><span style="font-family: comic sans ms,comic
sans,sans-serif;" data-mce-style="font-family: comic sans
ms,comic sans,sans-serif;">Chris.</span><br>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>
--------------000002090802010306070500--
--===============1885479313351410683==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--
[ Drupal support list | http://lists.drupal.org/ ]
--===============1885479313351410683==--