#26250 [Opn->Csd]: may view source of all files

ID: 26250 Updated by: goba@php.net Reported By: tspiteri at ieee dot org -Status: Open +Status: Closed Bug Type: Website problem PHP Version: Irrelevant -Assigned To: +Assigned To: goba New Comment: Well, the source page just tries to check some files so what is not intended for the usual viewers will not be viewed. There are multiple options to get those files for anyone (like setting up a local mirror site), so you have not found a security hole :) By the way, I have added a check on the .. component, so there will be no such inconsistencies in the future. Previous Comments: ------------------------------------------------------------------------ [2003-11-14 05:22:55] tspiteri at ieee dot org Description: ------------ If I try to view the source of e.g. /backend/index.php using: http://www.php.net/source.php?url=/backend/index.php I get an error message: Invalid file or folder specified But I can view it using: http://www.php.net/source.php?url=/manual/../backend/index.php ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=26250&edit=1