Disable relative path in php.ini

[howa]

As I remember, php has a settings which can disable the PHP codes to
open a file like that...
<?php

echo file_get_contents("../temp/../test.php");

?>

Anyone can confirm is that such a setting?

thanks.

[Rik]

howa wrote:

As I remember, php has a settings which can disable the PHP codes to
open a file like that...

<?php
echo file_get_contents("../temp/../test.php");
?>

Anyone can confirm is that such a setting?

I have no idea which setting this would be. open_basedir can be used to
box users in, maybe that's what you're after?

--
Rik Wasmus

[Toby A Inkster]

howa wrote:

echo file_get_contents("../temp/../test.php");

Easy way is to just check to see whether your file path matches this PCRE:

#(^|/)..(/|$)#

That is the start of the string followed by '../'; or '/../' anywhere in
the string; or '/..' at the end of the string; or the string consisting
only of '..'.

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
Geek of ~ HTML/SQL/Perl/PHP/Python*/Apache/Linux

* = I'm getting there!

[Mityok]

If you are trying to solve shared-hosting security problems, check
capter 42 of manual (Safe mode)
http://www.php.net/manual/en/features.safe-mode.php
Hope this will help.

howa:

As I remember, php has a settings which can disable the PHP codes to
open a file like that...
<?php

echo file_get_contents("../temp/../test.php");

?>

Anyone can confirm is that such a setting?

thanks.