Re: Re: vulnerability on php.net web site
| From: | Patrick Schaaf | Date: | Fri, 04 Apr 2014 07:40:03 +0000 |
| Subject: | Re: Re: vulnerability on php.net web site | ||
| References: | 1 2 | Groups: | php.webmaster |
| Request: | Send a blank email to php-webmaster+get-18700@lists.php.net to get a copy of this message | ||
On Friday 04 April 2014 07:13:39 Rasmus Lerdorf wrote:
> >
> > http://www.php.net/cached.php?t=1396464012&f=/cached.php
> Unless you can show files outside of the docroot, this is not a bug. All the
> source code for the site is public and anyone can view it on git.php.net.
> We used to also have a "show source" right on the site. cached.php has code
> in place to prevent it from accessing anything outside the docroot.
Code (realpath comparison to documentroot) looks fine in that regard.
Got me thinking, though: would it be okay, and maybe good to put into the
example on the mirroring page, to paranoidly run the rsync for the mirrors
with the --safe-links option? Right now I can find no symlinks at all in
phpweb, but that would still permit in-tree symlinking.
best regards
Patrick