Re: hacks we should know about
| From: | Rasmus Lerdorf | Date: | Fri, 17 Aug 2001 04:00:56 +0000 |
| Subject: | Re: hacks we should know about | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-63120@lists.php.net to get a copy of this message | ||
> hi i found it very helpful to know about hacks such as the below list
> and was wondering if anyone had any more dumb mistakes they could tell
> us before we make them.
>
> 1. http://www.somesite.com/source.php3?url=/etc/passwd
> 2. http://www.somesite.com?page=../../../../etc/passwd
> 3. not setting .inc files to be parsed by php
This is the wrong solution to securing include files. The correct
solution is to block any direct access to .inc files by either putting
them outside your document root or by using an Apache deny rule.
-Rasmus