Re: include bug in 5.3
| From: | Stefan Esser | Date: | Sat, 09 Aug 2008 11:35:57 +0000 |
| Subject: | Re: include bug in 5.3 | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-39795@lists.php.net to get a copy of this message | ||
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hello Dmitry,
while you are at fixing realpath() it might be a good idea to fix the
../ nonsense.
What I mean is:
fopen("this_is_not_a_dir_but_a_file/../../../../../../../../etc/passwd",
"r");
works because of realpath() and PHP's wrapper.
Same for
fopen("this_is_not_existing/../../../../../../../../etc/passwd", "r");
Both is madness...
Stefan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iEUEARECAAYFAkidgR0ACgkQSuF5XhWr2nhovACXZpeATBITDai/M1wsCuavuZ3C
OgCgn46uM4XHwENW7si4aJzeNgnuTKg=
=QiYy
-----END PGP SIGNATURE-----