note 69333 added to ref.curl
| From: | leif at harmsen dot net | Date: | Thu, 31 Aug 2006 20:34:28 +0000 |
| Subject: | note 69333 added to ref.curl | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-116566@lists.php.net to get a copy of this message | ||
Hey guys,
If you weren't experienced computer people you'd never believe this weirdness....
I couldn't for the life of me post anything with the word 'curl' in it. I discovered
this when trying to enter my friend Alex Curley into my contact database, then narrowed the problem
down to the string "curl". His email also wouldn't work - rather than the page
processing normally, I just get a forbidden 403 error. I thought it might be some weird html entity
problem. Googled it, and it got even weirder.
http://wordpress.org/support/topic/20758
Apparently this PHP function curl or c-rul can be used in some sort of post data to exploit that is
very serious. The quick fix was to ban the string "curl" from any post by returning a 403
error!!! This has terrible consequences for people with the letters curl in their name or email
address or website, or curl hair for a living or sell curlers or whatever. You can't even say
"curl up" or "curly hair" or "All of them had hair of gold, like their
mother, the youngest one in curls".
Is it possible to implement a more elegant solution that can determine if it is a malicious attempt
or simply the word or letter combination "curl"? Or do I just have to wait until the
next php version, if ever, to be able to add my friend to my database?! Yikes!
----
Server IP: 66.207.199.35
Probable Submitter: 24.42.81.187
----
X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER
autolearn=no version=2.64
----
Manual Page -- http://www.php.net/manual/en/ref.curl.php
Edit -- https://master.php.net/note/edit/69333
Del: integrated -- https://master.php.net/note/delete/69333/integrated
Del: useless -- https://master.php.net/note/delete/69333/useless
Del: bad code -- https://master.php.net/note/delete/69333/bad+code
Del: spam -- https://master.php.net/note/delete/69333/spam
Del: non-english -- https://master.php.net/note/delete/69333/non-english
Del: in docs -- https://master.php.net/note/delete/69333/in+docs
Del: other reasons-- https://master.php.net/note/delete/69333
Reject -- https://master.php.net/note/reject/69333
Search -- https://master.php.net/manage/user-notes.php