Re: [PHP3] File upload potential security hole (not PHP's fault) From: Alexander Aulbach (ssilk <email protected>)
Date: 09/17/98

On Wed, 16 Sep 1998, Ben Ginter wrote:

}Hello,
}
}I have built a couple of message boards (check out http://section9.org)
}and I just added the ability to attach files to messages.
}
}If you do something like this, where someone can upload a file and then it
}is linked on a page, be careful that you don't allow users to upload files
}with extensions that are parsed by the web server. If you don't check for
}this, someone can write a little php script to display your passwd file
}or whatever else they want to do.
}
}I check the filename and discard it if it matches a server parsed
}extension.
}
}if (eregi("[php3|phtml|shtml|cgi|htaccess]", $attachment_name)):
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This regular expression is WRONG!!! Replace [] throug () and it is ok.

Optimzing your regex with a search for the end:

     eregi("(php3|phtml|shtml|cgi|htaccess)$" .... 

-- 

SSilk - Alexander Aulbach - Herbipolis/Frankonia Minoris - (0931)22032

--
PHP 3 Mailing List   http://www.php.net/
To unsubscribe send an empty message to php3-unsubscribe <email protected>
To subscribe to the digest list:  php3-digest-subscribe <email protected>
For help: php3-help <email protected>  Archive:  http://www.php.net/mailsearch.php3