[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <46234FED.9090600@crasman.fi>
Date: Mon, 16 Apr 2007 13:29:01 +0300
From: Taneli Leppä <taneli@...sman.fi>
To: bugtraq@...urityfocus.com
Subject: Re: Critical phpwiki c99shell exploit
Hello,
Gadi Evron wrote:
> This is a good best practice, but it doesn't hold water long
> range. Further, where do you disallow these extensions? In the
> application?
> Mostly what the bad guys would do is upload, say.. .jpg, and then rename
> it.
This is what I do in Apache to directories used to store user
uploaded files:
<Directory "/var/www/html/application/uploaded">
php_admin_flag engine off
</Directory>
--
Taneli Leppä | Crasman Co Ltd
<taneli@...sman.fi> | <http://www.crasman.fi/>
Powered by blists - more mailing lists