Re: Re[4]: [PHP] Re: jpeg Uploader issue
| From: | CPT John W. Holmes | Date: | Thu, 15 Jan 2004 16:15:49 +0000 |
| Subject: | Re: Re[4]: [PHP] Re: jpeg Uploader issue | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-174673@lists.php.net to get a copy of this message | ||
From: "Toby Irmer" <php@irmer.com>
> file: show.php
>
> <?
> header("Content-type: image/jpeg");
> readfile("/path/to/file/".$_GET["filename"]);
> ?>
>
>
> in your files:
>
> <img src="show.php?filename=myfile.jpg" ...>
>
> or something like that ;)
Are you trying to get him to compromise his server? I'm sure that's just a
simple suggestion, but it's horrible. This will allow a user to request the
contents of any file PHP has access to read...
---John Holmes...