note 33586 deleted from function.ob-get-contents by didou
| From: | didou@php.net | Date: | Tue, 01 Jul 2003 13:31:59 +0000 |
| Subject: | note 33586 deleted from function.ob-get-contents by didou | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-51275@lists.php.net to get a copy of this message | ||
Note Submitter: sybren@thirdtower.com
----
if(!substr_count($__script, '.php') && isset($_GET['nostringreply']))
die("can only request return of resource from a php script");
This is NOT GOOD! It allows for script to read from "exploit.php.sh" for instance. IIRC
it's also possible to include a remote file by using http or ftp, so checking on
".php" in the script name is no security at all.