Re:I think tumblr has a huge security hole
by bluesnowmonkey on Saturday March 19, 2011 @12:23PM
(#2343949)
Exactly right. There's no reason for a config file (or any of the setup code) to be writing output. A good way to force this is by immediately starting an output buffer with a callback that returns nothing, then calling ob_end_clean() after setup is complete.
You could do ob_start(); include '...'; ob_end_clean();, but it turns out that die() (say, in a custom error handler) () causes an implicit buffer flush. So it's not a foolproof solution.
Re:I think tumblr has a huge security hole
by bluesnowmonkey on Saturday March 19, 2011 @12:28PM
(#2343965)
You can attach a callback to the buffer to prevent that implicit flush.
ob_start(function() {});Thanks, I'll investingate and probably adopt it for my code :D
Re:I think tumblr has a huge security hole
by KevBurnsJr on Sunday March 20, 2011 @04:56AM
(#2345877)
Or register_shutdown_function - http://blog.kevburnsjr.com/php-fatal-error-500
Root of the issue is that by default php outputs anything not between php tags to the browser.
Perhaps some sort of buffer control at the top most include can disable output to browser until a later time. That's pretty much how templating systems work except they don't disable output afaik thus leaving possibility of this open.