Re: [Fwd: (SRADV00001) Arbitrary file disclosure through PHPfile upload] (fwd)
| From: | Rasmus Lerdorf | Date: | Mon, 04 Sep 2000 16:02:35 +0000 |
| Subject: | Re: [Fwd: (SRADV00001) Arbitrary file disclosure through PHPfile upload] (fwd) | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-15147@lists.php.net to get a copy of this message | ||
> There will be a series of advisories along the lines of this one, they'll
> show weakness in several MAJOR PHP applications, coded by people who
> consider themselves security concious like yourself. I believe it is simply
> NOT POSSIBLE to code securly in PHP with register globals enabled.
Please run any future security issues like this by php-dev@lists.php.net
before posting them to bugtraq. Let us at least verify the accuracy
before you post this stuff. Most people are still running PHP 3 out there
and for them whether or not register_globals is on or off has little to do
with this particular file upload issue. One POST variable overwriting
another will not be solved by turning off register_globals.
-Rasmus