Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:15131 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 63664 invoked by uid 1010); 21 Feb 2005 01:15:35 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 63629 invoked from network); 21 Feb 2005 01:15:34 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 21 Feb 2005 01:15:34 -0000 X-Host-Fingerprint: 213.237.67.135 213.237.67.135.adsl.by.worldonline.dk Linux 2.4/2.6 Received: from ([213.237.67.135:28813] helo=mail.ter.dk) by pb1.pair.com (ecelerity 1.2 (r4437)) with SMTP id 24/A3-32941-18139124 for ; Sun, 20 Feb 2005 19:55:30 -0500 Received: from workpenguin (workpenguin [192.168.1.32]) by mail.ter.dk (Symaskine) with SMTP id D0EFB8A4042 for ; Mon, 21 Feb 2005 00:59:07 +0100 (CET) To: internals@lists.php.net Date: Mon, 21 Feb 2005 00:58:38 +0100 Message-ID: References: <3rpv015dc59q2ha906bij5jfn6kssqqlse@4ax.com> In-Reply-To: <3rpv015dc59q2ha906bij5jfn6kssqqlse@4ax.com> X-Mailer: Forte Agent 1.91/32.564 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Subject: Re: How to help? (Bug #28932 - glob-error-harvesting code) From: php@ter.dk (Peter Brodersen) Hi, On Mon, 14 Feb 2005 01:56:41 +0100, in php.internals php@ter.dk (Peter Brodersen) wrote: >http://basedir.ter.dk/globeater.php >http://basedir.ter.dk/globeater.php?debug=3D1 >http://basedir.ter.dk/globeater.phps > >Is it really a-okay that a script in pure PHP under >safe_mode-restriction, under open_basedir-restriction, using any >native php configuration methods to prevent accessing directory >information, with no access to shells, other languages or other means >of retrieving information from the system still is able to retrieve >file lists, that might contain session files, opening the possibility >of session hijacking? No worries at all? That actually worries me :-) --=20 - Peter Brodersen