
System commands
-------

**Example:**

	    <?php

		/*
		Whenever a system command is finished, you should properly sanitise and escape this user input.
		System command functions examples are:
		system()
		eval()
		exec()
		*/

		/*
		First we want to filter the filenames for expected values, for this example we use only a-z/0-9
		Whenever the values are tampered with, we can assume an attacker is trying to inject malicious input
		*/
		if(!preg_match("/^[a-zA-Z0-9]+$/", $_POST['configure_options']){

				//Set a log for whenever there is unexpected user input with a threat level:
				setLog($_SESSION['userID'],"invalid expected input", "FAIL", date(dd-mm-yyyy), $privelige, "HIGH");

				/*
				Set counter; if counter hits 3, the user's session must terminated.
				After 3 session terminations the user's acount must be blocked.
				Given the high threat level, there will be immediate session termination:
				*/
				setCounter(3);
				
				//The die function is to make sure the rest of the php code is not excecuted beyond this point
				die;
		
			}
	 

		//Secondly, we define the allowed arguments
		$whiteList = "/^allowed argument$/";

		//Next we validate the incoming user input in a preg_match function
		$sanitised = preg_match($whiteList, $_POST['configure_options'], $matched);

		//If there is a match we can proceed 
		if($matched){
	
			//First we have to log the command came through the validation succesfully.
			setLog($_SESSION['userID'],"Command came succesfully through validations", "SUCCESS", date(dd-mm-yyyy), $privelige, "NULL");
	
			//Even though there is a match we still escape the shellcommand:
			$command = './configure '.$sanitised;
			$escaped_command = escapeshellcmd($command); 
	
			//Only after validation do we put the shellcommand into the system() function:
			system($escaped_command); 
		 }
		 else{		
			 //Set a log for whenever there is unexpected userinput with a threat level:
			 setLog($_SESSION['userID'],"Possible command injection attack on system function", "FAIL", date(dd-mm-yyyy), $privelige, "HIGH");       

			 /*
			 Set counter; if counter hits 3, the user's session must be terminated.
			 After 3 session terminations the user's acount must be blocked.
			 Given the high threat level there will be immediate session termination:
			 */
			 setCounter(3);
		
			 //The die function is to make sure the rest of the php code is not excecuted beyond this point
			 die(); 		
		}
	}

		?>


		
