5 ms·

I'm not a coder by any stretch of imagination, but I've managed to cobble together this simple PHP app for hosting my photos. Constructive feedback will be grea

• devwerks 11y ago
  It's great that you had a need and tackled it by writing a script. However, after a brief look at your source, you have a directory traversal vulnerability - there may be other issues too. You are taking a query parameter "d" and appending that to photo_dir which is then used in a variety of places. https://www.owasp.org/index.php/Path_Traversal https://www.owasp.org/index.php/Path_Traversal describes what a directory traversal is. Take a look at https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet or http://www.phptherightway.com/ http://www.phptherightway.com/ for some primers.
  • dmpop9mm 11y ago
    Thank you very much for your feedback and the pointers!