Re: cvs: php4 /main rfc1867.c

> Can we use meaningful names, with new code at least? :) > As to how to solve this (as the current fix will break *lots* of > scripts). The current fix will only break scripts that are receiving a file upload and has extra form fields named the same as the file upload form field. I really don't think this is "*lots* of scripts". > Am I correct in my understanding that this only happens in POST requests > that are go through rfc1867.c? If so, we should probably provide a > specialized solution here. We can probably add each 'dangerous', > to-be-protected variable name to a hash, and wrap php_register_variable() > with a function that would deny such variables to overwrite the existing > variables. Actually, we can probably make it in a way that this wrapper > will also add these strings to the hash. I think the specialized solution here is to simply change the semantics of file uploads a bit and encourage people to use the safer mechanism. But we needed a quick-fix to respond to the bugtraq in a timely fashion. The fix prevents the exploit outlined in the bugtraq. -Rasmus