|
Posted by Jerry Stuckle on 03/29/06 13:51
Frank Mutze wrote:
> hello
>
> Is there a method to forbid an attacker to exploit download.php
> in grabbing some "sensitive" file ?
>
> I mean using that kind of trick
>
> download.php?filename=../../../../../../../../../../../../etc/passwd
>
> thanks you
1. Validate the path and filename being downloaded
2. Don't run the webserver as root
3. Let Unix security help you.
Or, better yet - don't let them input the filename being downloaded. Rather,
give them a list of files and let them select. But don't give them the
filenames themselves - just descriptions. Look up the filenames when they
select which file they want to download.
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================
Navigation:
[Reply to this message]
|