uploader.php script

From: auto40951at_private
Date: Tue Mar 04 2003 - 09:12:13 PST

  • Next message: securityat_private: "[Full-Disclosure] Security Update: [CSSA-2003-008.0] Linux: php bypass safe_mode and injected control chars vulnerabilities"

    -----BEGIN PGP SIGNED MESSAGE-----
    
    The password is not enabled by default, but the readme has the following installation instructions:
    
    - ---
    
    open setup.php and edit these options
    
    $ADMIN[RequirePass] = "Yes";   // Checks to see if upload has a vaild
     password
    $ADMIN[Password] = "password";   // This is the password if the above
     option is Yes
    $ADMIN[UploadNum] = "5";  // Number of upload feilds to put on the html
    page
    $ADMIN[directory] = "uploads";  // The directory the files will be
    uploaded to (must be chmoded to 777)
    
    - ---
    
    I dunno if I would bet the bank on this security, but it is pretty clear in the readme that you should enable password protection. And obviously, change the default password. But hey, the package is 3k zipped, so I probably wouldn't expect a lot of cutting edge security features.
    -----BEGIN PGP SIGNATURE-----
    Version: Hush 2.2 (Java)
    Note: This signature can be verified at https://www.hushtools.com/verify
    
    wl4EARECAB4FAj5k31wXHGF1dG80MDk1MUBodXNobWFpbC5jb20ACgkQ7s7ZokLom1iV
    1ACePA69i2UliNnZ13GiUR+Xar+t98UAoIshyQbphWK6N7ww1dVK7ckTGn4j
    =2Ykd
    -----END PGP SIGNATURE-----
    
    
    
    
    Concerned about your privacy? Follow this link to get
    FREE encrypted email: https://www.hushmail.com/?l=2 
    
    Big $$$ to be made with the HushMail Affiliate Program: 
    https://www.hushmail.com/about.php?subloc=affiliate&l=427
    



    This archive was generated by hypermail 2b30 : Tue Mar 04 2003 - 14:10:52 PST