Re: include

On Thu, 29 May 2003, DokFLeed.Net wrote: > hi, > i think there is a problem with the include function, but am not sure if anyone noticed it > before or not so i didn't report to the bug > > but try this code > 1) assume user1 is running a forum > 2) user2 wants to grab his password and hosting on the same server as user1 > > user2 can simply run this code and he will grab all var on user1 site > PHP CODE > --------------------------- > include('/home/user1/public_html/forum/admin/config.php'); > echo "Variable list for User1: <b>"; > $arr = get_defined_vars(); > while (list ($key, $val) = each ($arr)) > { > echo "Varaiable Name: <b> $key => </b>Value: > $val</b><br>\n"; > } > ----------------------------- > i tried everything out there > .htaccess > php_value open_basedir "/" Why would you set open_basedir to "/" ? The whole point of open_basedir is exactly for this purpose. To restrict which directories someone can open files from. If you set it to "/" then doesn't protect anything. Set it such that people can only open files from their own doc_root by setting it for each virtualhost block in your httpd.conf file. -Rasmus