note 74568 added to security.filesystem

It seems to me in this particular instance that a simple check to make sure that name or partial pathname doesn't already exist would prevent this attack... if a 'passwd/etc/...' existed as the password directory, you couldn't create a username to exploit the hole in the first place. But that's only from a 'script user' perspective, it still doesn't protect your server from other sub-admin's badly written code. Don For ---- Server IP: 69.147.83.197 Probable Submitter: 67.8.42.148 ---- Manual Page -- http://www.php.net/manual/en/security.filesystem.php Edit -- https://master.php.net/note/edit/74568 Del: integrated -- https://master.php.net/note/delete/74568/integrated Del: useless -- https://master.php.net/note/delete/74568/useless Del: bad code -- https://master.php.net/note/delete/74568/bad+code Del: spam -- https://master.php.net/note/delete/74568/spam Del: non-english -- https://master.php.net/note/delete/74568/non-english Del: in docs -- https://master.php.net/note/delete/74568/in+docs Del: other reasons-- https://master.php.net/note/delete/74568 Reject -- https://master.php.net/note/reject/74568 Search -- https://master.php.net/manage/user-notes.php