jappix/jappix — Issue #28: php-files upload - security
Author: julienbarrier
Created: 2012-02-22 22:20:46+00:00
State: open
Labels: bug, high priority

> [23:06:42] <...> hm, the security-flaw in file-share.php with uploading php-files is not really fixed
> [23:07:30] <...> atleast on my server running ubuntu, i can still upload php-files and get them interpreted
> [23:08:09] <...> the user-variable is still not checked but used in the filepath also
> [23:14:23] <...> lets keep this simple like last time :D, the problem is that your issafe-function basicly sucks and maybe thinks about using a whitelist instead of a blacklist
> [23:14:56] <...> the last problem with files named "php" is now fixed, but now you have a problem with files named "php."
> [23:15:32] *** Cyril has joined the room
> [23:16:01] <...> "php." is interpreted as php atleast on apache [ubuntu] don't know why