note 46838 added to function.readfile
| From: | ThomasJespersen at osu1 dot php dot net | Date: | Mon, 25 Oct 2004 13:06:33 +0000 |
| Subject: | note 46838 added to function.readfile | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-79071@lists.php.net to get a copy of this message | ||
Remember if you make a "force download" script like mentioned below that you SANITIZE YOUR
INPUT!
I have seen a lot of download scripts that does not test so you are able to download anything you
want on the server.
Test especially for strings like ".." which makes directory traversal possible. If
possible only permit characters a-z, A-Z and 0-9 and make it possible to only download from one
"download-folder".
----
Manual Page -- http://www.php.net/manual/en/function.readfile.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+46838
Delete -- http://master.php.net/manage/user-notes.php?action=delete+46838&report=yes
Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+46838&report=yes&reason=bad+code
Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+46838&report=yes&reason=spam
Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+46838&report=yes&reason=useless+example
Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+46838&report=yes&reason=contains+commercial+links
Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+46838&report=yes&reason=useless+note
Reject -- http://master.php.net/manage/user-notes.php?action=reject+46838&report=yes
Search -- http://master.php.net/manage/user-notes.php