note 57642 added to security.filesystem

All of the fixes here assume that it is necessary to allow the user to enter system sensitive information to begin with. The proper way to handle this would be to provide something like a numbered list of files to perform an unlink action on and then the chooses the matching number. There is no way for the user to specify a clever attack circumventing whatever pattern matching filename exclusion syntax that you may have. Anytime you have a security issue, the proper behaviour is to deny all then allow specific instances, not allow all and restrict. For the simple reason that you may not think of every possible restriction. ---- Manual Page -- http://www.php.net/manual/en/security.filesystem.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+57642 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+57642&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+57642&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+57642&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+57642&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+57642&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+57642&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+57642&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+57642&report=yes Search -- http://master.php.net/manage/user-notes.php