Posted by R K on 10/25/06 14:19

If uploading enabled, file permissions can't stop a user from
uploading a file, say "hole.php", then executing that file with the
URL http://host/uploaddir/hole.php. All PHP files just have rw or just
r permissions and they are still executed by the server. Seems like a
PHP issue. Are we leaving this up to developers to take care not to
create this hole?

BTW, how do I fix this in an administrative way?

Thx
-R

[Back to original message]