Just a quick note. I finally pu this system into use and I discovered another security leak. For Example I have a directory with these files and directories:
index.php
aboutus
thisismusic
secretstuff
And you go to:
http://www.domain.com/index.php?p=aboutus/index
Everything goes well, seeing as how folders and directory structure are still compatable with this system. BUT if you have a password protected directory(secretstuff) and someone types:
They will immediately gain acess bypassing the security check…Does anyone know a way around this? I am actually using it to my advantage right now, but it is useful knowledge.
72 Reader Comments
Back to the ArticleJakks
Just a quick note. I finally pu this system into use and I discovered another security leak. For Example I have a directory with these files and directories:
index.php
aboutus
thisismusic
secretstuff
And you go to:
http://www.domain.com/index.php?p=aboutus/index
Everything goes well, seeing as how folders and directory structure are still compatable with this system. BUT if you have a password protected directory(secretstuff) and someone types:
http://www.domain.com/index.php?p=secretstuff/index
They will immediately gain acess bypassing the security check…Does anyone know a way around this? I am actually using it to my advantage right now, but it is useful knowledge.
Jakks
never use redirects throug the URL. Some one could do http://domain.tld/goto.php?s=/usr/var