note 51011 deleted from features.remote-files by nlopess
| From: | nlopess@php.net | Date: | Wed, 16 Mar 2005 15:13:44 +0000 |
| Subject: | note 51011 deleted from features.remote-files by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-86551@lists.php.net to get a copy of this message | ||
Note Submitter:
----
"It's important to understand that remote files included/required into your script are NOT
run on your server (as previous posts have suggested). "
WRONG. (this killed us our rootserver, and some CERTs have it published like http://www.heise.de/newsticker/meldung/51838)
this is actually the greatest security hole in php and I want it FIXED.
atleast change the PHP_INI_ALL of allow_url_fopen to PHP_INI_SYSTEM or something like that.
currently it is something like that:
ini_set( allow_url_fopen, "1");
include($_GET["i_am_remotecontrolled"]);
and every customer on our rootserver can bring in his hacking-kit.
luckily we have nearly no customers who are able to have their own scripts.