Re: PHP Security - "view source code"
| From: | Rasmus Lerdorf | Date: | Thu, 17 Jan 2002 16:41:37 +0000 |
| Subject: | Re: PHP Security - "view source code" | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-80930@lists.php.net to get a copy of this message | ||
> On Wednesday, January 16, 2002, at 08:04 PM, Rasmus Lerdorf wrote:
>
> > No, it is safer to block access to .inc files with an httpd.conf rule.
> > Allowing people to execute files that were meant to be included out of
> > context could end up being much more dangerous than simply having people
> > see the source.
> >
> > -Rasmus
> >
>
> So the technique of adding ".inc" to the list of extensions in "AddType
> application/x-httpd-php" line and just having PHP parse them as PHP code
> is unwise? Or should a combination of the two be used -- parsing ".inc"
> files *AND* blocking access to them in httpd.conf?
Correct, that is unwise. I would never register .inc as being PHP types
for the very reason I stated. Execution code out of the context it was
meant to be executed in is a very bad idea.
-Rasmus