Re: Re: [RFC] No PHP tags
| From: | Rasmus Lerdorf | Date: | Wed, 12 Feb 2014 01:29:01 +0000 |
| Subject: | Re: Re: [RFC] No PHP tags | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72490@lists.php.net to get a copy of this message | ||
On 2/11/14, 3:33 PM, Yasuo Ohgaki wrote:
> I forgot to mention 2nd. I usually disable engine for upload directory
> by httpd.conf
> or do not allow to upload anything under webroot.
Right, you don't put your upload dir under your webroot. Even with php
disabled, you wouldn't want your upload dir in your web root since the
bad guys could upload nasty javascript or other interesting things and
xss/csrf your users through that.
As for LFI, I usually just set my open_basedir to the directories I know
my application will access files from. So even if I make a mistake
somewhere, the bad guys won't be able to trick any of my includes into
including any other files. This seems like a much simpler and more
effective way to combat LFI than introducing a template mode.
-Rasmus
Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc
Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc