Re: [PHP4BETA] can't include .php3 files only .inc (I have php4) security issue

There are lines like this in your server config file: AddType application/x-httpd-php .php3 .inc .phtml .ph .php AddType application/x-httpd-php-source .phps Anything listed there is a valid extension for php, others apache will just see as text... In your example, you have config.something. If .something is in the list, then as long as you have <?php at the top of the file and ?> /NOTHING/ will be returned to browser (unless it is done explicitly by you...). --Joey Smith Please forgive the long sig: *** Notice To Bulk Emailers: Attention! Pursuant to US Code, Title 47, Chapter 5, Subchapter II, 227, any & all unsolicited commercial e-mail sent to this address is subject to a download and archival fee in the amount of the $1500 US and copies will be forwarded to domain administrators. Emailing denotes acceptance of said terms! On Fri, 10 Mar 2000, Jason Carlson wrote: > If I have a include('config.php3') statement in a file such as index.php3 of > which the config.php3 file has functions defined in it and in the index.php3 > file (after the include statement - or require statement) it makes a call to > that function I get an error saying that function has not been defined. > > Here's the confusing part. If I rename the config.php3 file that's being > called on by the include statement to 'config.inc' (or any extension not > recognized as a php file [or anything else for that matter]) it works > perfectly. > > This suggests to me that my server runs the included config.php3 file as if > it's a separate file all together from the one that's calling it thus why it > doesn't see the function. But when it's renamed to the .inc extension the > server doesn't run that file and just includes the text from it. > > This means I can get includes to work BUT my concern is that if my > config.inc file was discovered (either from a searchbot that ignores the > robot.txt instructions) or from a lucky guess of which the URL to that file > is entered - the person's browser shows it as a text file thus seeing the > source code and all the passwords and such that shouldn't be that public. > > Any suggestions. I'm sure it's a setup thing but my server provider does > not support PHP and I do not have root access to play around with myself. > But if one of you have a good suggestion of what needs changing, then maybe > I can convince them to look into setting it up properly. > > Any help would be really helpful on this. > > Jason Carlson > > > -- > PHP 4.0 Beta Mailing List <http://www.php.net/version4/> > To unsubscribe, e-mail: php4beta-unsubscribe@lists.php.net > For additional commands, e-mail: php4beta-help@lists.php.net > To contact the list administrators, e-mail: php4beta-admin@lists.php.net > >