note 48923 deleted from function.header by bjori
| From: | bjori@php.net | Date: | Mon, 27 Mar 2006 09:53:55 +0000 |
| Subject: | note 48923 deleted from function.header by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-106735@lists.php.net to get a copy of this message | ||
Note Submitter: crispiness at fastmail dot fm
----
If the below post didn't make this clear... be VERY VERY CAREFUL with download scripts! I had a
vulnerability for years in my download counting script; namely, the user could download ANY file on
the server. Including the PHP files that contained my database password!
The same potential vulnerability applies to any script that displays or downloads files from your
server. Caveat scriptor (let the programmer beware; and no, that's not proper Latin)!