3 ms·
If you have a PHP app, place nothing inside of web root other than an include to your front controller. This is all that should ever get exposed: include '
by nikcub 16y ago
If you have a PHP app, place nothing inside of web root other than an include to your front controller. This is all that should ever get exposed:
include '../app/front_controller.php';
- russss 16y agoThen, if you accidentally edit your front controller file so that it starts with 'i?php' instead of '<?php', it will get exposed. This is what happened with Tumblr.
- CWIZO 16y agoSure but you will expose only that line, which tells you almost nothing.
- nikcub 16y agoYou are right, it wil expose the front controller, but it wont expose the includes from there. If you screw up the open tag on the config file, even if it is outside of webroot it will be exposed I just tested a few variations on one of my old projects and the reason why I didn't see it is because I had ob_start() and was killing the buffer in my templating class (which is a good idea) not to mention that the db passwords were in an external yaml file anyway (most of the frameworks do this) which would get loaded and cached