note 120074 deleted from function.openssl-pkey-get-private by cmb
| From: | cmb@php.net | Date: | Tue, 21 Jan 2020 17:47:31 +0000 |
| Subject: | note 120074 deleted from function.openssl-pkey-get-private by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-213934@lists.php.net to get a copy of this message | ||
Note Submitter: geoff at hostfission dot com
----
Since this function can be used to load a PEM encoded string also, those that are using it relying
on user input should be sure to check that the passed data is indeed a PEM encoded string and not a
malicious file path.
The following should be sufficient.
<?PHP
$private = trim($_POST['private']);
if (strpos($private, '-----') !== 0) return false;
?>