Re: Re: patch to php 4.3.10 to disabling URL wrappers in include like statements
| From: | Tom Z Meinlschmidt | Date: | Wed, 02 Mar 2005 15:52:40 +0000 |
| Subject: | Re: Re: patch to php 4.3.10 to disabling URL wrappers in include like statements | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-209806@lists.php.net to get a copy of this message | ||
Tell me - how do you want to turn off remote includes and remain remote file working?
allow_url_fopen turns off _both_. There's no choice what to disable
tom
Jason Barnett wrote:
Tom Z. Meinlschmidt wrote:Hi, I've experienced a lot of attacks in my hosting server due to silly users and their scripts with holes. So I prepared this little patch to 4.3.10, which disables using url wrappers in include/include_once/require/require_once statemens (switchable in php.ini). See readme.security from patch patch is there: http://orin.meinlschmidt.org/~znouza/php_patch.txt comments are welcome /tomhttp://php.net/manual/en/ini.php#ini.list allow_url_fopen = 0