Is this a security issue?

[Patty]

I am wondering if this could be a security issue. If so, how should I fix this?

I have a script that allows the user to delete images on the server. The delete script has the server username and password in it as part of the code. This makes me nervous because if someone were to read this script, they would have access to the server and all the files!

Now on the server, I have .htaccess set to prevent directory browsing in the directory where the file is stored and the file the script is on is also password protected.

Is this secure enough?

[sneakyimp]

I don't understand why you need a username and password stored anywhere - is the server where images are deleted a different machine? if the permissions are set correctly, php can delete files without any user/pass afaik.

[Patty]

I am making a content management application for a client to update his web site without having to use a ftp client.

On one page, the client can upload images and also delete images already stored on the server.

The script I have fills an list box with the files (images) currently stored on the server in the directory and then allows him to select and delete them. The script I use to connect to the server needs password and username to connect to it.

I have the 'update' file password protected using .htpasswd and .htaccess

Code below in red is where the domain, username and password is entered in code

Is there a better way to do this?

<?php
$conn = ftp_connect("[COLOR="Red"]ftp.mydomain.com") [/COLOR]or die("Could not connect");
ftp_login($conn,"[COLOR="red"]myusername","mypassword[/COLOR]"); //USERNAME AND PASSWORD TYPED HERE

$content=(ftp_nlist($conn,"public_html/testing"));

ftp_close($conn);

?>

<font color='red'>Array filled selectbox: </font>
<br>

<form method="POST" action="<?php echo $PHP_SELF;?>">

<?php
selectboxArrayFill($content, "Arraybox"); //Test the Array fill

function selectboxArrayFill(&$array, $selboxname){
  echo '<SELECT size="8" name="'. $selboxname.'" >';

reset($array);
  while(list($key, $value)= each($array)){

  if(trim($value)!=="." && trim($value)!=="..")
  {

   echo "\n <OPTION value='".$value."'>".$value."</OPTION>"; 
   }
  }

  echo "\n</SELECT>\n";
}

?>

<input type="submit" name="delete" value="Select files and delete">
</form>

<br><br>


<?php
if (isset($_POST['delete']))
{

$fileToDelete= $_POST['Arraybox'];

// set up the settings
$file = 'public_html/testing/';
$file = $file . $fileToDelete;

$ftp_server = [COLOR="red"]'mydomainname.com'[/COLOR];
$ftpuser = [COLOR="red"]'myusername[/COLOR]';
$ftppass = '[COLOR="red"]mypassword'[/COLOR];

// set up basic connection
$conn_id = ftp_connect($ftp_server);

// login with username and password
$login_result = ftp_login($conn_id, $ftpuser, $ftppass);

// try to delete $file
if (ftp_delete($conn_id, $file)) { // the ftp function
echo "$file deleted successfully\n";
} else {
echo "could not delete $file\n";
}

// close the connection
ftp_close($conn_id);
}

?>

[sneakyimp]

My question was: Is this code you are writing running on the same machine that is hosting the images? If so, you can just use [man]unlink[/man].

If not, the user/pass must be stored somewhere. If you are concerned about someone getting access to it, it might be helpful to define the user/pass as a constant in a separate file which gets included and then place that file outside the web root.