Re: Security Concerns with Uploaded Images:
| From: | Rory Browne | Date: | Wed, 17 May 2006 13:19:02 +0000 |
| Subject: | Re: Security Concerns with Uploaded Images: | ||
| References: | 1 2 3 4 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-236343@lists.php.net to get a copy of this message | ||
On 5/16/06, Richard Lynch <ceo@l-i-e.com> wrote:
On Mon, May 15, 2006 1:58 am, Jason Wong wrote: 2) the uploaded file is a "script" (perl/php/python/etc) In the case of (2), if the script relies on its shebang line to execute Not necessarily -- What if I upload an "image" file named "badscript.php" and then I surf to it, after it's in your /images directory?When using the php apache module, from a OS permissions, the Server reads as opposed to executes php code. .php files don't generally need to be executable IIRC. Game Over
If you want Shifflet's view, just go to http://phpsec.org -- Like Music? http://l-i-e.com/artists.htm -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php