|
|
Posted by Geoff Berrow on 02/27/07 23:37
Message-ID: <op.tofh7y0270mclq@cp139795-a.landg1.lb.home.nl> from
OmegaJunior contained the following:
>> How would a gallery script show the contents of a .php file?
>
>That highly depends on the gallery script, doesn't it? If the script would
>perform an fopen() or file() on any file name it receives, and then echoes
>the result to the browser, you bet the contents of a .php will be shown.
>
>If the gallery script merely enters the received file name into the src
>attribute of an img element, there's little to fear. But if we'd enter it
>into the data attribute of an object element or the href attribute of an
>iframe element, there's a lot to fear.
Thanks, I just thought it was worth pointing that out to the OP to
prevent needless paranoia.
--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/
Navigation:
[Reply to this message]
|