Posted by Oli Filth on 12/06/05 06:36

bio-anomoly said the following on 06/12/2005 04:15:
> I was just giving my PHP a bit of a spin, and I noticed that opendir
> opens EVERYTHING, and unix commands can be executed with the ' grave,
> like this 'ls -lR /'.
>
> Can someone quantify how slack this is? Is it normal practice amongst
> large servers?
>
> When the security is this crap, what else can happen?


Forgive me if I'm missing something, but surely this is irrelevant as
long as you write decent code, that doesn't allow users to, for
instance, execute arbitrary shell commands?


--
Oli

[Back to original message]