Re:I think tumblr has a huge security hole
by eam on Saturday March 19, 2011 @08:30AM
(#2343427)
I believe the way to do it "correctly" would be to put the actual file containing the credentials in a non-public location and just do an include where you need to access it. At least that's how I do it. I could be wrong...
[ Parent
| on HN ]
Re:I think tumblr has a huge security hole
by drdaeman on Saturday March 19, 2011 @08:48AM
(#2343459)
If one would made a similar typo in that file, its contents will be displayed too.
A solution would be to have a .ini-like (or some other simple-to-parse format) config file and PHP code to read its contents. PHP code could be leaked, but config file contents wouldn't.
Re:I think tumblr has a huge security hole
by robryan on Saturday March 19, 2011 @09:15AM
(#2343513)
Yeah seen a few client libraries that are doing that. Even putting them in a config only file lessens the chance of something like this happening as it is modified a lot less often.
[deleted]
Re:I think tumblr has a huge security hole
by drdaeman on Saturday March 19, 2011 @09:12AM
(#2343507)
I believe you are wrong. include()/require() would equally happily display any file's contents outside of `<?php ... ?>` scope (the case with "i?php"), within document root or not.
Edit: I've tested this:
$ php -v
PHP 5.2.6-3ubuntu4.6 with Suhosin-Patch 0.9.6.2 (cli) (built: Sep 16 2010 19:51:25)
Copyright (c) 1997-2008 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies
$ cat test.php
<?php
require "/tmp/test2.php";
?>
$ cat /tmp/test2.php
i?php
define("TEST", "test");
?>
$ GET http://localhost/test.php
i?php
define("TEST", "test");
?>Off course, but in this case, passwords would only be exposed if the config file had a miss-typed opening PHP tag. If "test.php" had it, you wouldn't be able to see the contents of "test2.php".
Re:I think tumblr has a huge security hole
by drdaeman on Saturday March 19, 2011 @10:09AM
(#2343606)
Yes, you are right. And in this exact case they (mis-)edited the file, that contained passwords (i.e. test2.php in my improvised example).
Sure, I was replying for this hypothetical situation that you guys ware discussing, where they would store passwords in a different file outside of webroot ...
Re:I think tumblr has a huge security hole
by sewerhorse on Saturday March 19, 2011 @09:11AM
(#2343503)
it's always included to the document root (the bootstrap file). it doesn't matter where you're including from, a broken open tag would cause errors like this one.
Re:I think tumblr has a huge security hole
by windsurfer on Saturday March 19, 2011 @08:40AM
(#2343443)
If you're doing an include, wouldn't the passwords still be in a PHP file?
if the php file is printed rather than executed, the include will not be followed.
You'd see the "include /path/to/inaccessible/file" but you wouldn't see the passwords within the include.
I think. I haven't seriously used php since 2003 or so.
Yes, but included files still need a <?php tag at the top, or PHP just prints them out.