@phpdeveloper.org
Content no longer valid
Subscribe
News Archive
Looking for more information on how to do PHP the right way? Check out PHP: The Right Way
Hiveminds Magazine:
PHP: What to Do When Your Web Host Turns Off Fopen
Link:
PHP: What to Do When Your Web Host Turns Off Fopen
Jan 01, 2007 @ 14:43:00
Link:
Hiveminds Magazine:
PHP: What to Do When Your Web Host Turns Off Fopen
Link:
PHP: What to Do When Your Web Host Turns Off Fopen
Jan 01, 2007 @ 14:43:00
Content no longer valid
Link:
PHP Security Blog:
PHP 5.2.0 and allow_url_include
Link:
PHP 5.2.0 and allow_url_include
Nov 03, 2006 @ 15:41:23
On the PHP Security Blog, Stefan Esser has posted some of his own opinions on the latest PHP release - version 5.2 - and some of the security implications of it.
Often users have requested that PHP allows disabling URL support for include and require statements while allowing it for the other filesystem functions. Because of this it was planned to have allow_url_include in PHP 6. After some discussion the feature was backported to the PHP 5.2.0 tree.
He also notes that, unfortunately, this functionality only protects against the http(s) and ftp(s) kinds of URLs and not some of the new data URLs included in the functionality of PHP 5.2. He gives two code examples of this kind of issue - one using the "pph://input" and the other using a base64 encoded value.
Link:
PHP Security Blog:
PHP 5.2.0 and allow_url_include
Link:
PHP 5.2.0 and allow_url_include
Nov 03, 2006 @ 15:41:23
On the PHP Security Blog, Stefan Esser has posted some of his own opinions on the latest PHP release - version 5.2 - and some of the security implications of it.
Often users have requested that PHP allows disabling URL support for include and require statements while allowing it for the other filesystem functions. Because of this it was planned to have allow_url_include in PHP 6. After some discussion the feature was backported to the PHP 5.2.0 tree.
He also notes that, unfortunately, this functionality only protects against the http(s) and ftp(s) kinds of URLs and not some of the new data URLs included in the functionality of PHP 5.2. He gives two code examples of this kind of issue - one using the "pph://input" and the other using a base64 encoded value.
Link:
Trending Topics: