Trailing slash SERVES SOURCE!!!!!!

tha_mink

Yikes...while I was doing some work on a clients site I noticed that if I write a url like this...

The server doesn't parse any of the php. Wassup with THAT?

After doing some random checking around sites that I know use php...I have found the same situation.

The server I run at home doesn't have this problem but lots of shared servers that my clients use have the issue. Even though I can't fix it myself on the shared machines I would love to get the sysadmins to fix it so that the source stays hidden.
so like.....

Anyone know why this happens???

tha_mink

PHPdev

Sounds like the webserver is taking the last / as part of the extension, which it does not recognise and thus sends the contents to the browser.

I just tried that on my server and it still executed the page.

PHPdev

tha_mink

Yeah...it doesn't serve source on my server either...but three of the shared servers my clients use do. And what's worse is that if there is an include...let's say...

include("../../sql_config.php");...

Typing the url... http://server.com/../../sql_config.php/

will serve the php source...db passwords etc. Even though ../../ should be protected by .htaccess. I have told the sysadmins and they will probably take care of it but...I just keep wondering why.

BTW all the servers are solaris. and the hosting companies do quite a bit of e-commerce through them.

Yikes.

tha_mink