note 73629 added to function.readfile
| From: | AdamF at osu1 dot php dot net | Date: | Mon, 05 Mar 2007 05:29:05 +0000 |
| Subject: | note 73629 added to function.readfile | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-124080@lists.php.net to get a copy of this message | ||
egingell at sisna dot com's comment is COMPLETELY wrong.
That still allows access to system files (just because they dont end in .php doesnt mean they arnt
worth protecting), and gives an attacker free reign at any file the webserver process can access.
Proper escaping through a php function is highly recommended if whitelisting files isnt an option.
----
Server IP: 203.202.10.60
Probable Submitter: 203.59.102.165
----
Manual Page -- http://www.php.net/manual/en/function.readfile.php
Edit -- https://master.php.net/note/edit/73629
Del: integrated -- https://master.php.net/note/delete/73629/integrated
Del: useless -- https://master.php.net/note/delete/73629/useless
Del: bad code -- https://master.php.net/note/delete/73629/bad+code
Del: spam -- https://master.php.net/note/delete/73629/spam
Del: non-english -- https://master.php.net/note/delete/73629/non-english
Del: in docs -- https://master.php.net/note/delete/73629/in+docs
Del: other reasons-- https://master.php.net/note/delete/73629
Reject -- https://master.php.net/note/reject/73629
Search -- https://master.php.net/manage/user-notes.php