Re: [PHP4BETA] can't include .php3 files only .inc (I have php4) security issue

Jason Carlson wrote: > > If I have a include('config.php3') statement in a file such as index.php3 of > which the config.php3 file has functions defined in it and in the index.php3 > file (after the include statement - or require statement) it makes a call to > that function I get an error saying that function has not been defined. > > Here's the confusing part. If I rename the config.php3 file that's being > called on by the include statement to 'config.inc' (or any extension not > recognized as a php file [or anything else for that matter]) it works > perfectly. > > This suggests to me that my server runs the included config.php3 file as if > it's a separate file all together from the one that's calling it thus why it > doesn't see the function. But when it's renamed to the .inc extension the > server doesn't run that file and just includes the text from it. > > This means I can get includes to work BUT my concern is that if my > config.inc file was discovered (either from a searchbot that ignores the > robot.txt instructions) or from a lucky guess of which the URL to that file > is entered - the person's browser shows it as a text file thus seeing the > source code and all the passwords and such that shouldn't be that public. > > Any suggestions. I'm sure it's a setup thing but my server provider does > not support PHP and I do not have root access to play around with myself. > But if one of you have a good suggestion of what needs changing, then maybe > I can convince them to look into setting it up properly. > > Any help would be really helpful on this. General advice: keep your include files out of the documentroot directory. In projects, I usually have a public_html directory and a lib/php directory, and set PHP's include_path to ".:/project/lib/php:/usr/local/lib/php". But include() should work regardless of the file name. Are you running with safe_mode? Try narrowing down the problem a bit more by for example putting only "foo" (no PHP tag) in config.php3 and see what happens. - Stig