create unique page

jackmaessen

using 2.0.18.10

I am trying to make this script working on a page called "develop". I created this page with the Custompages plugin.
So what i want is when a member wants to create a project, he is referred to a unique page in which is a textarea he can create code an when submit, code is being outputted on another unique page.
I use this script for it but of course, there is a problem with the route that should be manually created.
How can i make this working?

<?php

if($_SERVER['REQUEST_METHOD'] == 'POST')
{
// generate random code
function randomString($length = 8) {
 $str = "";
 $characters = array_merge(range('a','z'), range('0','9'));
 $max = count($characters) - 1;
 for ($i = 0; $i < $length; $i++) {
  $rand = mt_rand(0, $max);
  $str .= $characters[$rand];
 }
 return $str;
}

$code = randomString();

$naam = $_POST['naam']; 

// create page with the unique code
$fileLocation = getenv("DOCUMENT_ROOT") . "/test/".$code.".php"; // path where .php files are created
$file = fopen($fileLocation,"w");
$content = "Hello <b>".$naam."</b>;&nbsp;this is your unique page!"; //content of the page
fwrite($file,$content);
fclose($file); 

// after submit, redirect to the page
header('Location: '.$code.'.php');

} //closebracket server request
?>

Under this comes the form

R_J

SetRoute function should do what you want: https://github.com/vanillaforums/Garden/search?q=setroute&type=Code

You could also think of dispatching the calls through your controller.

The page you want to redirect to must have a unique id and as far as I can see you are only creating a random string. Most probably there will be no duplicates, but I would use timestamp+userid.
If you want to create a unique page, couldn't you reuse a discussion?

hgtonight

The idea is that someone goes to your page, enters some data. That data is then stored on the server in a unique file. Which then can be executed on your server?

The security implications of this process are too numerous to enumerate. I am not going to say you can't. I definitely suggest you don't.

jackmaessen

@hgtonight Yes, you have a serious point. I did not think about the security. People can use "unset" or "rmdir" and when submit destroy a lot. It was actually meant for creating a development area but i understand it is too risky. People can abuse it.

hgtonight

You might just direct them to this site: http://www.tehplayground.com/