Re: include

Since you got a public_html system you can set open_basedir to "..:/tmp" which means access to there home folder and the /tmp folder. my host also uses it like above .: Allowee On Thursday 29 May 2003 18:08, Rasmus Lerdorf wrote: > On Thu, 29 May 2003, DokFLeed.Net wrote: > > hi, > > i think there is a problem with the include function, but am not sure if > > anyone noticed it before or not so i didn't report to the bug > > > > but try this code > > 1) assume user1 is running a forum > > 2) user2 wants to grab his password and hosting on the same server as > > user1 > > > > user2 can simply run this code and he will grab all var on user1 site > > PHP CODE > > --------------------------- > > include('/home/user1/public_html/forum/admin/config.php'); > > echo "Variable list for User1: <b>"; > > $arr = get_defined_vars(); > > while (list ($key, $val) = each ($arr)) > > { > > echo "Varaiable Name: <b> $key => </b>Value: > > $val</b><br>\n"; > > } > > ----------------------------- > > i tried everything out there > > .htaccess > > php_value open_basedir "/" > > Why would you set open_basedir to "/" ? The whole point of open_basedir > is exactly for this purpose. To restrict which directories someone can > open files from. If you set it to "/" then doesn't protect anything. > Set it such that people can only open files from their own doc_root by > setting it for each virtualhost block in your httpd.conf file. > > -Rasmus