Re: allow_url_include and php:/data:
| From: | Peter Brodersen | Date: | Sat, 04 Nov 2006 21:12:56 +0000 |
| Subject: | Re: allow_url_include and php:/data: | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-26327@lists.php.net to get a copy of this message | ||
On Sat, 04 Nov 2006 12:40:01 -0800, in php.internals
rasmus@lerdorf.com (Rasmus Lerdorf) wrote:
>Yeah, we probably should. Had a chat with Wez about it too. Here is
>the patch. I think this catches the cases we are interested in:
>
> http://lerdorf.com/php/is_url.diff
>
>If someone could doublecheck it against those attacks it would be helpful.
Would requests to a smbserver, e.g.
\\10.20.30.40\evil\malicious_php_code.txt be prevented as well? It
seems like smbserver requests are regarded as part of the default
filesystem wrapper.
--
- Peter Brodersen