note 11379 deleted from function.show-source by jimw
| From: | jimw@php.net | Date: | Fri, 07 Dec 2001 02:31:01 +0000 |
| Subject: | note 11379 deleted from function.show-source by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-21833@lists.php.net to get a copy of this message | ||
Two little comments and suggestions:
First of all.. ($DOCUMENT_ROOT . $filename) is not that secure.. Someone could ask for a filename of
/../../../etc/passwd and if you eval $DOCUMENT_ROOT . "/../../../etc/passwd", it would get
to the real "/etc/passwd".
One solution would be to:
$try_file = realpath(dirname($filename));
if (ereg("^" . $DOCUMENT_ROOT, $try_file)) { ... }
Second thing, if you want to further process the show_source(), maybe to strip passwords, you can
try this little trick -- I am not responsible of incompatibilities with some webserv. ;)
ob_start();
show_source($DOCUMENT_ROOT . $filename);
$buffer = ob_get_contents();
ob_end_clean();
print($buffer);
Hope this could help - Olivier