can't include .php3 files only .inc (I have php4) security issue
| From: | Jason Carlson | Date: | Fri, 10 Mar 2000 10:01:43 +0000 |
| Subject: | can't include .php3 files only .inc (I have php4) security issue | ||
| References: | 1 | Groups: | php.version4 |
| Request: | Send a blank email to php-version4+get-11857@lists.php.net to get a copy of this message | ||
If I have a include('config.php3') statement in a file such as index.php3 of
which the config.php3 file has functions defined in it and in the index.php3
file (after the include statement - or require statement) it makes a call to
that function I get an error saying that function has not been defined.
Here's the confusing part. If I rename the config.php3 file that's being
called on by the include statement to 'config.inc' (or any extension not
recognized as a php file [or anything else for that matter]) it works
perfectly.
This suggests to me that my server runs the included config.php3 file as if
it's a separate file all together from the one that's calling it thus why it
doesn't see the function. But when it's renamed to the .inc extension the
server doesn't run that file and just includes the text from it.
This means I can get includes to work BUT my concern is that if my
config.inc file was discovered (either from a searchbot that ignores the
robot.txt instructions) or from a lucky guess of which the URL to that file
is entered - the person's browser shows it as a text file thus seeing the
source code and all the passwords and such that shouldn't be that public.
Any suggestions. I'm sure it's a setup thing but my server provider does
not support PHP and I do not have root access to play around with myself.
But if one of you have a good suggestion of what needs changing, then maybe
I can convince them to look into setting it up properly.
Any help would be really helpful on this.
Jason Carlson