Re: [RFC] Script only include/require
| From: | Yasuo Ohgaki | Date: | Tue, 24 Feb 2015 22:53:33 +0000 |
| Subject: | Re: [RFC] Script only include/require | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-83710@lists.php.net to get a copy of this message | ||
Hi Stas,
On Wed, Feb 25, 2015 at 7:31 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:
> > I think he means matching file "extension". File extension should
> > represent file type, though.
>
> You can not rely on that. I can name files anything regardless of what's
> in the file.
>
> > Since "pwnd.php" has ".php" extension, move_uploaded_file() refuses to
> > move it
> > to upload dir by default.
>
> There's no pwnd.php. The file that I upload is "cuteponies.gif". Please
> look at the sequence again carefully.
require('cuteponies.gif) wouldn't work with this RFC.
move_uploaded_files() prohibits uploading PHP script.
I noticed that I should forbid destination file extension also by this
discussion.
I'll add it soon. Thank you.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net