From d34d225b86cd6facb7981a397f1b8f831a976fa6 Mon Sep 17 00:00:00 2001 From: Rasmus Lerdorf Date: Mon, 2 Oct 2000 05:23:18 +0000 Subject: [PATCH] Fix a couple of mistakes git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@33253 c90b9560-bf6c-de11-be94-00142212c4b1 --- chapters/security.xml | 10 +++++----- security/index.xml | 10 +++++----- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/chapters/security.xml b/chapters/security.xml index 893c98ddea..257f6db2e5 100644 --- a/chapters/security.xml +++ b/chapters/security.xml @@ -301,7 +301,7 @@ AddHandler php3-script .php3 interface is regularly used for file management, so the Apache user is allowed to delete files in the user home directories. - + Filesystem attack @@ -318,12 +318,12 @@ echo "$file_to_delete has been deleted!"; Since the username is postable from a user form, they can submit a username and file belonging to someone else, and delete files. In this case, you'd want to use some other form of authentication. - + User Submitted Data - + The greatest weakness in many PHP programs is not inherent in the language itself, but merely an issue of code not being written with security in mind. For this reason, you should always take the time @@ -360,8 +360,8 @@ exec ($evil_var); Can unusual or undesirable data be acted upon? - + Can this script be used in unintended ways? @@ -381,7 +381,7 @@ exec ($evil_var); By adequately asking these questions while writing the script, rather than later, you prevent an unfortunate re-write when you need to oncrease your security. - + diff --git a/security/index.xml b/security/index.xml index 893c98ddea..257f6db2e5 100644 --- a/security/index.xml +++ b/security/index.xml @@ -301,7 +301,7 @@ AddHandler php3-script .php3 interface is regularly used for file management, so the Apache user is allowed to delete files in the user home directories. - + Filesystem attack @@ -318,12 +318,12 @@ echo "$file_to_delete has been deleted!"; Since the username is postable from a user form, they can submit a username and file belonging to someone else, and delete files. In this case, you'd want to use some other form of authentication. - + User Submitted Data - + The greatest weakness in many PHP programs is not inherent in the language itself, but merely an issue of code not being written with security in mind. For this reason, you should always take the time @@ -360,8 +360,8 @@ exec ($evil_var); Can unusual or undesirable data be acted upon? - + Can this script be used in unintended ways? @@ -381,7 +381,7 @@ exec ($evil_var); By adequately asking these questions while writing the script, rather than later, you prevent an unfortunate re-write when you need to oncrease your security. - +