Date: 04/15/05 (PHP Community)    Keywords: php, security

Hey everybody..

I've got kind of a weird problem, so let me explain what I'm trying to do before I get into code snippets.

I am working on a project where I want to do some kind of update notification when a user uses a "check for updates" type link. Each file in the script has a variable with a rev number. Ideally, I would like it to hit a script on MY site that has a "master" list of rev numbers. When I update one of the files, I put it up on the server and update the rev number in the master list. Ultimately (I have not gotten this far yet), the script will compare rev numbers from the manifest on the client side against the master list and then offer the new rev scripts as .txt file as downloads. I don't want it to automatically replace or download these files to the server directly for security reasons.



So far, my update script parses these files and gets the rev number on the client side without any problem. What I'm having problems with is actually getting the script to obtain and parse the master list from my site to compare with the generated manifest on the client side.

So far, I've thought about using file() to load the rev numbers into arrays, but if I do that, it'll be a HUGE pain to update the master file list with new rev numbers. Ideally, I'd like to have it include() a .php file on the other end that will read variables, then it would be a simple if between the $master_file_name (from my server) and the $client_file_name variables (from the client server). What I really don't want to do is do this via FTP unless I have to. I have to keep security in mind and it's bad enough I'm coding a script to try to snag stuff from a remote server, I really don't want to get ftp or a http download involved.

If I use file() (and use a text file rather than a php file), I could probably use str_replace() to cut out the variables on the client side, the only problem is the function I would need to write would likely be huge as the variables on the "master" list are all different. I also thought about doing this on the master/server side by writing some kind of "export" script or backend that will generate the file from the master.php file..include() won't work as my server parses it before sending it off.

Anyone got any hints as to what I need to do or a better way to do this?

Source: http://www.livejournal.com/community/php/285733.html