>include("../../../mainfile.php");
>
>include($phpbb_root_path.'common.'.$phpEx);
>
>...
>
>in mainfile.php at lines 54-56
>
>...
>
>import_request_variables('GPC');
Oh, OK - now that makes sense. This looks like one aspect of the
"globals overwrite" problem as originally documented by Stefan Esser
in the article "$GLOBALS Overwrite and it's Consequences"
http://www.hardened-php.net/index.76.html
The article mentions extract() as well, and the behavior differs
between PHP4 and PHP5.
With respect to variables that seem to be cleansed - I've seen this
odd behavior once or twice before, but I don't remember the specifics
and can't dig up the Bugtraq post :-(
- Steve
