|
Posted by d on 03/29/06 19:02
"Frank Mutze" <nospam@all.net> wrote in message
news:e0dk62$hkc$1@s1.news.oleane.net...
> hello
>
> Is there a method to forbid an attacker to exploit download.php
> in grabbing some "sensitive" file ?
>
> I mean using that kind of trick
>
> download.php?filename=../../../../../../../../../../../../etc/passwd
>
> thanks you
The easiest way is to remove any path elements that navigate up the
directory structure:
$path=str_replace("../", "", $path);
that would at least keep it within your documentroot. Comparing the
realpath() is the most secure, however.
dave
Navigation:
[Reply to this message]
|