4 ms·
If one would made a similar typo in that file, its contents will be displayed too. A solution would be to have a .ini-like (or some other simple-to-parse forma
by drdaeman 16y ago
If one would made a similar typo in that file, its contents will be displayed too.
A solution would be to have a .ini-like (or some other simple-to-parse format) config file and PHP code to read its contents. PHP code could be leaked, but config file contents wouldn't.
- deleted 16y ago[deleted]
- sewerhorse 16y agoit's always included to the document root (the bootstrap file). it doesn't matter where you're including from, a broken open tag would cause errors like this one.
- drdaeman 16y agoI believe you are wrong. include()/require() would equally happily display any file's contents outside of `<?php ... ?>` scope (the case with "i?php"), within document root or not. Edit: I've tested this: $ php -v PHP 5.2.6-3ubuntu4.6 with Suhosin-Patch 0.9.6.2 (cli) (built: Sep 16 2010 19:51:25) Copyright (c) 1997-2008 The PHP Group Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies $ cat test.php <?php require "/tmp/test2.php"; ?> $ cat /tmp/test2.php i?php define("TEST", "test"); ?> $ GET http://localhost/test.php i?php define("TEST", "test"); ?>
- CWIZO 16y agoOff course, but in this case, passwords would only be exposed if the config file had a miss-typed opening PHP tag. If "test.php" had it, you wouldn't be able to see the contents of "test2.php".
- drdaeman 16y agoYes, you are right. And in this exact case they (mis-)edited the file, that contained passwords (i.e. test2.php in my improvised example).
- CWIZO 16y agoSure, I was replying for this hypothetical situation that you guys ware discussing, where they would store passwords in a different file outside of webroot ...
- robryan 16y agoYeah seen a few client libraries that are doing that. Even putting them in a config only file lessens the chance of something like this happening as it is modified a lot less often.