3 ms·

How did someone "expose the PHP source code"? Did they actually find a way to make the code show up client-side, or was it just someone who managed to get acce

• MitziMoto 13y ago
  Sounds like it was an "accident". The web server served up the source code rather than compiling the PHP, which someone then saved.
• bouk 13y ago
  I think it was a glitch in Apache that made it spill out the sourcecode
• 0x0 13y ago
  It can happen if you upgrade Apache and/or mod_php, and for some reason mod_php fails to register for .php files without being a fatal startup error. Then apache will serve the .php files as plaintext. It's one of the things that make one-off .php scripts easy to deploy (just chuck it into the webroot). With a little effort, this can be mostly prevented: let the webroot .php file just do an ' include("../outside-webroot/actual-script.php"); '
• vezzy-fnord 13y ago
  Another possibility is some quirk in the file permissions, .htaccess or some other configuration file, which could lead to vulnerabilities like HTTP verb tampering. It may have been more subtle, but of a similar nature.
• smsm42 13y ago
  They misconfiguring apache to serve php as text file instead of being processed by php engine. One missing line in apache config can do that. It didn't last long, but of course people saved every bit that was leaked this way. Which is mostly entry points of course.