note 55467 added to ref.curl

Hello! CURL function make security hole at your site.... Just read that PHP cURL functions bypass open_basedir protection, so users can navigate through filesystem. For example, setting "open_basedir" in php.ini to "/var/www/html" anybody can retrieve "/etc/parla" using cURL functions. == Proof of concept (curl.php) <?php $ch = curl_init("file:///etc/parla"); $file=curl_exec($ch); echo $file ?> More details here: http://www.securityfocus.com/archive/1/379657/2004-10-26/2004-11-01/0 ---- Manual Page -- http://www.php.net/manual/en/ref.curl.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+55467 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+55467&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+55467&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+55467&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+55467&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+55467&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+55467&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+55467&report=yes Search -- http://master.php.net/manage/user-notes.php