On mer, 2002-06-05 at 14:27, Jens Frank wrote:
Hello,
the user "Mrzha" uploaded a file named filelist.PHP. This file provides a file system browser to inspect all directories on the web server it is installed to. Can an administrator please delete this file and ensure that no PHP-files are interpreted when stored in /upload/?
I've deleted it, but I can't do anything preemptive.
It's occasionally been suggested that the software might be changed to reject certain file types, or only accept certain file types, but it's never really gotten discussed or implemented. Theoretically, one might well want to upload a sample PHP source file to go along with the article about PHP (as, for instance, there are a couple Ruby scripts up there)... but it sure as heck shouldn't be runnable on the server!
This filelist.PHP is not very harmful, but using the same way it might be possible to hijack the entire server. (As done with www.apache.org some years ago, also starting with an upload directory executing PHP to get an "initial contact").
A while ago I sent Jimbo a fix for this problem (that is, uploaded .php files being runnable) for the Apache configuration. I don't know if it didn't get installed, or if it got installed but didn't work.
Here it is again: ----------------------------------------------------------------------- Something like this should override the PHP setting (and anything else in that directory that would be getting special treatment from the server):
<Directory /bla/bla/wikipedia/upload> SetHandler default-handler </Directory> -----------------------------------------------------------------------
Can someone please confirm when this has been put in place?
-- brion vibber (brion @ pobox.com)