ID: 23779
Updated by: georg@php.net
Reported By: php at jkt dot wz dot cz
-Status: Open
+Status: Assigned
Bug Type: MySQL related
Operating System: any
PHP Version: 4.3.1
Assigned To: georg
Previous Comments:
------------------------------------------------------------------------
[2003-05-27 03:07:27] georg@php.net
Hmm..
...assigned to myself
------------------------------------------------------------------------
[2003-05-27 02:53:25] php at jkt dot wz dot cz
a) not security hole in mysql, it's problem of php
b) you don't need file privileges for 'load data local infile'
solution:
add php.ini option mysql_local_infile;
in mysql_connect() check for 128 and if not enabled, clear it (ie.
option&0x7f)
------------------------------------------------------------------------
[2003-05-24 01:34:19] georg@php.net
It's not a security hole. This only works when the
connected user has file privileges.
------------------------------------------------------------------------
[2003-05-23 19:10:18] sniper@php.net
After a bit more thinking, this is not really PHP problem
to solve, it's a security hole in Mysql..
------------------------------------------------------------------------
[2003-05-23 19:02:30] sniper@php.net
Only solution I can think of is to deny the use of
MYSQL_OPT_LOCAL_INFILE either totally or just when safe-mode is
enabled..
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/23779--
Edit this bug report at http://bugs.php.net/?id=23779&edit=1