database password visible!!
| From: | Arjen Sas | Date: | Mon, 12 Mar 2001 18:16:38 +0000 |
| Subject: | database password visible!! | ||
| Groups: | php.mirrors | ||
| Request: | Send a blank email to php-mirrors+get-4446@lists.php.net to get a copy of this message | ||
Hey Webmaster,
When you hit the source code link, you can see which files are included in the documents, for
example configuration.inc file.
When you hit source code in search.php this piece of code appears:
[code]
if (file_exists("configuration.inc")) {
include_once 'configuration.inc';
}
[/code]
So, I thought, let's open this file! And there this neat code appears:
[code]
<?
$dbname = "php3";
$root_url = "/";
$base_url = ereg_replace("[^/]*\$","",$PHP_SELF);
$dbhost="localhost";
$dbuser="nobody";
$dbpwd="";
$htsearch_prog="/local/htdig/bin/htphp.sh";
?>
[/code]
Maybe it's a good idea to change in to .php or so?? I wasn't going to do something with
this data, but you never know who will do something tricky with this.
Greetz,
Arjen Sas
PS my English maybe not so well, I'm Dutch... Sorry!