4 ms·

Then, if you accidentally edit your front controller file so that it starts with 'i?php' instead of '<?php', it will get exposed. This is what happened with Tu

by russss 16y ago

Then, if you accidentally edit your front controller file so that it starts with 'i?php' instead of '<?php', it will get exposed. This is what happened with Tumblr.

CWIZO 16y ago
Sure but you will expose only that line, which tells you almost nothing.
- CWIZO 16y ago
  Down voter: care to explain why? My statement is correct ...
  - Terretta 16y ago
    I didn't vote on your remark, but elsewhere in this thread, it's demonstrated with six lines of PHP that the contents will be exposed.
nikcub 16y ago
You are right, it wil expose the front controller, but it wont expose the includes from there. If you screw up the open tag on the config file, even if it is outside of webroot it will be exposed I just tested a few variations on one of my old projects and the reason why I didn't see it is because I had ob_start() and was killing the buffer in my templating class (which is a good idea) not to mention that the db passwords were in an external yaml file anyway (most of the frameworks do this) which would get loaded and cached
- russss 16y ago
  The ob_start thing is an exceedingly good point and I don't know why I didn't think of it myself. Probably because I haven't touched PHP in 3 years.
  - nikcub 16y ago
    > Probably because I haven't touched PHP in 3 years. we should start a support group