note 31446 deleted from function.include by sniper
| From: | sniper@php.net | Date: | Tue, 04 Nov 2003 00:41:26 +0000 |
| Subject: | note 31446 deleted from function.include by sniper | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-59785@lists.php.net to get a copy of this message | ||
Note Submitter: damien@NOSPAM.atypix.com
----
You may think its secure to set an include base before dynamic include file. but its not sufficient.
try this index.php?file=../../../etc/passwd
so use this function instead include($file) if $file come from user.
<?
function secure_include($file)
{
$include_base="/home/includes/";
$file=str_replace("../","",$file);
$file=str_replace("..","",$file);
$file=str_replace("//","/",$file);
if(file_exists($include_base.$file))
{
include_once($include_base.$file);
}
}
//SECURE USER INCLUDE
secure_include($_REQUEST["file"]);
?>
NOTE: you must use the same tips for fopen(), file()... use with user path.