#26471 [Opn->Bgs]: Big security hole in directory acces system

ID: 26471 Updated by: derick@php.net Reported By: hdf at vipmail dot hu -Status: Open +Status: Bogus Bug Type: *Directory/Filesystem functions Operating System: Win32 PHP Version: 4.3.3 New Comment: Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php It's not PHP's job to secure a webserver. And we have an 'open_basedir' setting for this. Previous Comments: ------------------------------------------------------------------------ [2003-11-30 06:13:15] hdf at vipmail dot hu Description: ------------ It is possible (very easily) to scan the whole filesystem structure of the server, on wich the php script is running, including all partitiones and drives. The problem is I think that there is no limiting option in php, about how many levels upwards in the directory tree are alowed for a script. I have made a little "Troyan horse php script", wich can scan the filesystem of the server, and even read in the textfiles on it. Reproduce code: --------------- http://members.chello.hu/hdf13/MyPrograms/dirlist.zip Expected result: ---------------- It runs perfectly, but it shouldn't. :) Actual result: -------------- The whole server filesystem is visible and browsable and textfiles in it are readeable. Serious security hole! ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=26471&edit=1