Slashdot Mirror

What would be nice would be a register within a PHP script that simply identified which functions were called. In the meantime, this works well for me...

PHP 5.1 has 3 different function call executors that can be enabled at compile time. While none of them do this (they are mainly geared towards performance; there's a huge leap in function call performance in 5.1), it would be trivial enough to modify one of them (or create your own, the framework is modular enough) to log the call.

For alternatives to your current system, check out intercept from PECL to avoid having to use a register_shutdown_function (consider that I can evade your shutdown function by causing a fatal or parse error after my exploit code; e.g., exploit_code_here(); eval('::');). Another advantage of intercept is that you can actively disallow calling the functions from being called from restricted scripts instead of logging it after the fact and then banning the IP. Main disadvantage of course being that the maintainer hasn't seen fit to change the status from alpha although the extension itself is stable as is its API.

Another possible vulnerability of your script exists if you have the runkit extension enabled in which case it'd be possible to undefine the constant after it was created. Of course, runkit can be used to evade most security cordons you could construct (imagine just redefining the shutdown function to do something else) so this isn't surprising. Rather unlikely that you've got it enabled or that an attacker would know to do it, however.

Agreed on the unfortunate tendency to use cute and/or silly names for Open Source products. Another example: there is a framework for persistent PHP objects under development which is called PHP Bananas (warning: PDF link; Google HTML version here).

Hanging on to these silly 'geek inside joke' code names is not helping adoptation of OSS.

JP