note 48472 deleted from function.include by nlopess
| From: | nlopess@php.net | Date: | Sat, 25 Dec 2004 21:57:04 +0000 |
| Subject: | note 48472 deleted from function.include by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-82295@lists.php.net to get a copy of this message | ||
Note Submitter: dwlnetnl at hotmail dot com
----
I've found a security leak in php. Look at http://www.hardened-php.net/documentation.php
paragraph 2.4.3 for more information.
Here is some script code to fix this leak.
<?php
// $_GET["page"] is the GET query var for the requesting
// file on the webserver.
if (!preg_match("/[\.\\/%00:]/", $_GET["page"]) &&
!empty($_GET["page"]))
{
include("/path/" . $_GET["page"] . ".inc.php");
include_once("/path/" . $_GET["page"] . ".inc.php");
require("/path/" . $_GET["page"] . ".inc.php");
require_once("/path/" . $_GET["page"] . ".inc.php");
}
else
{
die("Hacking attempt.");
}
?>
If you don't check the GET query var for this, hackers can use this var in the query to include
other php script files.