Daniel Stenberg a écrit : On Thu, 6 Nov 2008, curl wrote:
      
    $ch = curl_init('file:///c:\test.txt');
  
...it is possible to bypass the php_admin_value open_basedir and see the contents of file.
  
I would like to know if it's possible to solve this issue and how to do.
      
  Why enable file:// support in libcurl at all if you don't want it?
      
  And if PHP has a dynamic way that should prevent access to such URLs, it should prevent access to them in the libcurl binding layer I would say.
      
    Sorry but i don't know how to disable file:// support in libcurl...i need to recompile php_curl.dll without file:// support ? Are you saying that ? :)

haroon ahmad a écrit :
No, you cannot by pass open_basedir restriction. Yes i can ! that's the problem :)

_______________________________________________
http://cool.haxx.se/cgi-bin/mailman/listinfo/curl-and-php
Received on 2008-11-06