note 5812 modified in Handling file uploads by sniper
| From: | sniper@php.net | Date: | Mon, 04 Sep 2000 22:13:21 +0000 |
| Subject: | note 5812 modified in Handling file uploads by sniper | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-4152@lists.php.net to get a copy of this message | ||
Be careful with the handling of $userfile.
Say upload.php3 simply displays the file on the screen,
or mails it.
Guess what happens if you try http://somewhere/upload.php3?userfile=/etc/passwd
I consider this a bug (or a design flaw).
---
Try with latest CVS..this should be fixed now...
http://www.php.net/manual/handling-file-uploads.php