Hacker News Reader

Comment by lifeformed | Hacker News Reader

How did someone "expose the PHP source code"? Did they actually find a way to make the code show up client-side, or was it just someone who managed to get access to the backend stuff? The way it's worded makes it sound like the former, but that seems unlikely...

View on HN

It can happen if you upgrade Apache and/or mod_php, and for some reason mod_php fails to register for .php files without being a fatal startup error. Then apache will serve the .php files as plaintext.

It's one of the things that make one-off .php scripts easy to deploy (just chuck it into the webroot). With a little effort, this can be mostly prevented: let the webroot .php file just do an ' include("../outside-webroot/actual-script.php"); '

They misconfiguring apache to serve php as text file instead of being processed by php engine. One missing line in apache config can do that. It didn't last long, but of course people saved every bit that was leaked this way. Which is mostly entry points of course.

Sounds like it was an "accident". The web server served up the source code rather than compiling the PHP, which someone then saved.

I think it was a glitch in Apache that made it spill out the sourcecode

Another possibility is some quirk in the file permissions, .htaccess or some other configuration file, which could lead to vulnerabilities like HTTP verb tampering.

It may have been more subtle, but of a similar nature.

Reply on news.ycombinator.com