note 68331 added to function.readfile

########## QUOTE: ######### oryan at zareste dot com 26-Nov-2005 08:18 As Grey said below: Readfile will send users un-executed PHP files, which makes it easy to exploit vulnerabilities. It's common - and easy - to use GET variables pointing to downloadable files, like script.php?v=web/file.mov , but this lets users to change it to script.php?v=index.php and get damaging info. Even POST variables can be exploited this way if the user's on a custom browser. To keep secure, limit downloadable files to one directory, like 'web/', so that script.php?v=file.mov will send web/file.mov, and scan the variable for '..' and 'php' to make sure users can't go into other directories, or open php files you may have stupidly put under web/. This should cover all the bases. ########## /QUOTE: ######### Or you can check the file extention and make sure it's not PHP. <? $ext = pathinfo($_REQUEST['v'], PATHINFO_EXTENSION); if (strtolower($ext) == 'php') die('You are trying to view files that you have no business viewing.'); ?> Also note: If readfile() is used on external sites, such as 'http://www.php.net', you will output what your visitors would see if they were to go to that site by typing it into their web browser's address bar. Only all of the page's relative paths, such as in the link <a href="next_page.html">Next Page</a>, will resolve to files in your file's scope *not* the original site's scope, thus if you don't have a matching "next_page.html" in the same directory, visitors will get a 404 error when clicking the "Next Page" link. Same goes with <img>, <embed>, <object>, <link>, <form>, etc. ---- Server IP: 216.194.113.175 Probable Submitter: 71.35.197.135 ---- X-Spam-Status: No, hits=3.9 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER, HTML_IMAGE_ONLY_10,HTML_MESSAGE autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.readfile.php Edit -- http://master.php.net/note/edit/68331 Del: integrated -- http://master.php.net/note/delete/68331/integrated Del: useless -- http://master.php.net/note/delete/68331/useless Del: bad code -- http://master.php.net/note/delete/68331/bad+code Del: spam -- http://master.php.net/note/delete/68331/spam Del: non-english -- http://master.php.net/note/delete/68331/non-english Del: in docs -- http://master.php.net/note/delete/68331/in+docs Del: other reasons-- http://master.php.net/note/delete/68331 Reject -- http://master.php.net/note/reject/68331 Search -- http://master.php.net/manage/user-notes.php