Re: Parent Limits?
| From: | Brian Smither | Date: | Thu, 30 Jun 2011 18:30:19 +0000 |
| Subject: | Re: Parent Limits? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-313831@lists.php.net to get a copy of this message | ||
With all kind respect to Richard Buskirk and Daniel Brown (thank you for responding), their replies
did not actually answer my question.
My question is: What module or php.ini setting would render inoperative a directory traversal of X
parents?
My original post follows.
The following works (three parents):
include("../../../includes/ini.inc.php");
require_once("../../../includes/ini.inc.php");
The following works (four parents):
include("../../../../includes/ini.inc.php");
The following does not work (four parents):
require_once("../../../../includes/ini.inc.php");
That is, require_once() with four parents has been reported to have been disabled for security
purposes. But apparently, not disabled is include() with four parents.
The device or setting which is causing the problem is not known to me. It may be just the four
parents (and include() is getting the data from this file elsewhere) or it may be the combination.
It has been reported this is not a limit within open_basedir. So, what is it? What module or php.ini
setting would have this effect?
Thank you.