PHP require() circumvents IIS security? Please help.
| From: | Jack Kelly Dobson | Date: | Mon, 28 Oct 2002 19:01:41 +0000 |
| Subject: | PHP require() circumvents IIS security? Please help. | ||
| Groups: | php.windows | ||
| Request: | Send a blank email to php-windows+get-16597@lists.php.net to get a copy of this message | ||
Hello,
I just noticed something very concerning and hope someone has some
answers...
I'm running php 4.2.3 under W2k IIS as a .dll.
I have a directory set up with no anonymous access to it and security set to
"Integrated Windows Authentication".
If I try to load the page directly from the browser
"/my_site/my_secure_directory/password_protected_file.php" I get the
password dialog from Windows asking me to log in.
On the other hand:
If I require the file from a non-protected file; say "/index.php" has the
line:
"require('/my_site/my_secure_directory/password_protected_file.php');" in
it, I'm not asked for a password and the page is included in the output.
Is there something I'm missing here, or is this a bug?
Thanks in advance.
j-