Is This Php Script Safe?

[DWD]

I found a php script for a server load display button here. The code is as follows:

 

<?php

/* name: severload.php

Author: Jesse Chilcott

Description: This script creates a horozontal meter that shows the server load

Useage: link to the script as if it is an image

*/

 

 

/* get and set more image and font details */

$im = imageCreate(80,15);

 

$width = imagesx($im);

$height = imagesy($im);

$textcolor = imagecolorallocate($im, 0, 0, 0);

$textcolor2 = imagecolorallocate($im, 255,255,255);

$fillcolor1 = imagecolorallocate($im, 255,255,255);

$fillcolor2 = imagecolorallocate($im, 255,85,0);

$metercolor = imagecolorallocate($im, 0,240,0);

$bordercolor = imagecolorallocate($im, 0,0,0);

$bordercolor2 = imagecolorallocate($im, 40,40,40);

$textWidth = imagefontwidth($font) * strlen( $str );

$textHeight = imagefontheight($font);

 

/* get server load */

if (file_exists("/proc/loadavg") == true)

{

$fp = @fopen("/proc/loadavg", "r");

if (empty($fp) == false)

{

$loadavg = explode(" ", fread($fp, 6));

fclose($fp);

$loadav = substr($loadavg[0], 0, 4); // we don't want to many digits or it will overlap the meter

}

else

{

$loadav = "error";

}

}

else

{

$loadav = "error";

}

 

 

header("Content-type: image/gif");

 

$xLoc = 23;

$yLoc = 0;

 

/* over lap background image from the right with a white rectangle */

imagefilledrectangle ( $im, 0 ,0, $width, $height, $fillcolor1 );

imagefilledrectangle ( $im, 0 ,0, $width/4, $height, $fillcolor2 );

imagerectangle ( $im, 0,0, $width -1, $height-1, $bordercolor );

imagestring($im, 4, 4, $yLoc-1, "SL", $textcolor2);

imagestring($im,2, $xLoc, $yLoc, $loadav, $textcolor);

 

/* do meter bar */

if ($loadav != "error") {

$limit = 20; //this is the upper limit of the range of server load values... adjust to your server

$percent = ($loadav * 100) /$limit;

$meterwidth = ($percent / 100) * 28;

if ($meterwidth > $limit)

$meterwidth = $limit;

imagefilledrectangle ( $im, 48 ,4, 48 + $meterwidth, $height-6, $metercolor );

imagerectangle ( $im, 48,4, 76, $height-6, $bordercolor2 );

}

/* output gif image to browser */

imageGIF($im);

imagedestroy($im);

?>

 

The above php file is supposed to be in the main directory and then linked to by:

 

<a href="http://jesse.bur.st/"><img src="/serverload.php" alt="Server Load" border="0"></a>

Is this safe and secure?

 

From what little I know about code it appears to be, but at the same time if someone told me the code allowed someone to reroute military satellites from my site, I'd just node my head and say, "I knew that."

[DWD]

It doesn't seem to work for me. The script writer says, "you will need to have read access to ‘/proc/loadavg’."

 

Do we have such access?

[TweezerMan]

On shared servers, PHP does not have access to /proc or /proc/loadavg.