3 ms·
I agree with you, but here the problem is not the extract() call as everyone here seems to imply. The security problem lies in the fact that the authentication
by p4bl0 12y ago
I agree with you, but here the problem is not the extract() call as everyone here seems to imply.
The security problem lies in the fact that the authentication code is conditionally called depending on user input.
if ($login) { … }
is not less safe than
if ($_POST['c99shcook']['login']) { … }
would have been.
- 4mnt 12y agoI'm pretty sure $login can be set to true/false somewhere on top of the file as 'configuration'. Only it gets overwritten by the call to extract(). It was not meant to be user input
- p4bl0 12y agoI feel stupid. Of course, you are right.
- heydenberk 12y agoDon't feel stupid. This is difficult to reason about, hence the existence of the bug and the inadvisability of PHP's `extract` function.