Re: download script
| From: | Aaron Todd | Date: | Wed, 11 Aug 2004 18:57:43 +0000 |
| Subject: | Re: download script | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-193362@lists.php.net to get a copy of this message | ||
Why would this be a security hole if I do not filter the file name before I
use it?
Thanks,
Aaron
"Ed Lazor" <Ed.Lazor@d20News.com> wrote in message
news:php.general-193359@news.php.net...
> The other guys addressed how to get the script working, but I thought I
> might also mention that you're presenting a potential security hole in
your
> app by not filtering the file name before using it. You'll also want to
use
> the realpath command on the full file name and path.
>
> > -----Original Message-----
> > $file = "/home/dlr/test/".$_GET['file']."";