Sec Bug->Bug #66160 [Opn]: PHP file used to load CSS and JS (cached.php) on new site reveals source code

Edit report at https://bugs.php.net/bug.php?id=66160&edit=1 ID: 66160 Updated by: johannes@php.net Reported by: josiah at josiahkeller dot com Summary: PHP file used to load CSS and JS (cached.php) on new site reveals source code Status: Open -Type: Security +Type: Bug Package: Website problem Operating System: N/A PHP Version: Irrelevant Block user comment: N Private report: Y New Comment: This seems to be limited to files in the webroot, all files there are public and accessible from our git or rsync servers. Removing security flags so that the full web team can take a look and decide whether extra checks make sense ... Previous Comments: ------------------------------------------------------------------------ [2013-11-23 16:29:35] josiah at josiahkeller dot com Description: ------------ In the new site redesign, a file called "cached.php" is used in the href for the stylesheet <link> tags, and in the src for a few <script> tags. A GET parameter called "f" determines what file is served. However, it looks like just about any path can be manually passed in that parameter, and the script will output the contents of that file, even if it's a PHP source code file. Not knowing what files are accessible this way, I thought this should be reported, as for all I know there could be sensitive info that could be found out this way. Expected result: ---------------- It probably ought to reject requests to .php or .inc files. Actual result: -------------- It doesn't. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66160&edit=1