Menu

#74 Shouldn't use SERVER_NAME for encryption

beta_version
open
security (2)
8
2005-03-16
2005-03-16
No

Hmmmm... unless... I ran the upgrade from the linux
browser. What if the "Server Name" looks different?
That would cause the wrong key to be used for the DB
password. AHA! phpinfo() has different SERVER_NAME
from different places. A quick edit to the hosts file
got both browsers working. Further testing shows that
SERVER_NAME comes from the client's URL, not internally
from the server. Not a good choice for an encryption key.

Discussion


Log in to post a comment.