Re: Show filenames using Wildcards -- The glob() Solution!
| From: | Rahul Sitaram Johari | Date: | Tue, 03 Apr 2007 13:04:17 +0000 |
| Subject: | Re: Show filenames using Wildcards -- The glob() Solution! | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-251980@lists.php.net to get a copy of this message | ||
Ave,
I understand what you're saying, and logically I guess I need to validate $F
and verify if it contains a concoction of what I want to be publicly
accessible, and nothing else.
Is there any other suggestions you can provide in helping secure this flaw?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Rahul Sitaram Johari
CEO, Twenty Four Seventy Nine Inc.
W: http://www.rahulsjohari.com
E: sleepwalker@rahulsjohari.com
³I morti non sono piu soli ... The dead are no longer lonely²
On 4/1/07 1:59 AM, "Richard Lynch" <ceo@l-i-e.com> wrote:
> The problem is that with "readfile($F)" you've just made ALL the files
> that PHP can read *also* publicly accessible.
>
> This includes all your PHP source code, /etc/passwd, and all around
> *WAY* too much stuff all over your server.