Re: Newbie: Safe function call to a .inc file outside the web folder
| From: | Chris Shiflett | Date: | Fri, 26 Aug 2005 01:44:07 +0000 |
| Subject: | Re: Newbie: Safe function call to a .inc file outside the web folder | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-221387@lists.php.net to get a copy of this message | ||
Graham Anderson wrote:
Is the below reasonable safe ?
I have all of my main functions outside the web folder
I am including this function with every php script that
accesses fonovisa.inc
function getBrain()
{
$temp = explode('.', $_SERVER['SERVER_NAME']);
Because $_SERVER['SERVER_NAME'] can be manipulated by the user in some cases, you must consider $temp tainted at this point.
$size = count($temp);
$server = $temp[$size -2];
Therefore, this is a security vulnerability. Hope that helps. Chris -- Chris Shiflett Brain Bulb, The PHP Consultancy http://brainbulb.com/$brainPath = "/home/".$server."/includes/fonovisa.inc";