Re: [RFC] Script only include/require
| From: | Stanislav Malyshev | Date: | Tue, 24 Feb 2015 23:06:01 +0000 |
| Subject: | Re: [RFC] Script only include/require | ||
| References: | 1 2 3 4 5 6 7 8 9 10 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-83714@lists.php.net to get a copy of this message | ||
Hi!
> require('cuteponies.gif) wouldn't work with this RFC.
> move_uploaded_files() prohibits uploading PHP script.
You seem not to be reading the scenario. The include URL would be
phar://cuteponies.gif/pwnd.php and the uploaded file would be
cuteponies.gif. Your protection would not stop moving .gif file, and
your filename check would pass phar://cuteponies.gif/pwnd.php since it
ends in .php.
--
Stas Malyshev
smalyshev@gmail.com