4 ms·
Assuming the reddit posters are correct. This means the PHP app knew the public IP. Isn't the only way to know about it to enter it into the web server configur
by amalag 12y ago
Assuming the reddit posters are correct. This means the PHP app knew the public IP. Isn't the only way to know about it to enter it into the web server configuration?
- psaintla 12y agoNo, there are several $_SERVER variables available to all php applications. The two relevant ones in this case would be HTTP_HOST and SERVER_ADDR, most likely the author of the application was leaking one of those in his application.
- amalag 12y agoBut a webserver does not know its external IP, that is the whole confusion. Don't PHP docs say: 'SERVER_NAME' The name of the server host under which the current script is executing. If the script is running on a virtual host, this will be the value defined for that virtual host. 'HTTP_HOST' Contents of the Host: header from the current request, if there is one.
- psaintla 12y ago1.) You're assuming that the script was running on a vhost, we don't know. 2.) Even if the script is running in a vhost, if a listening port is specified but not an IP address the SERVER_NAME will be the IP of whatever the interface the http connection came from was.