# if ($path){
# $ips = file("$path/lists/bannedips.php");
# } else {
# $ips = file("lists/bannedips.php");
# }
# if (in_array($REMOTE_ADDR,$ips)) {
# echo($bannedmessage);
# die;
There might be a terminology problem here.
I don't see how this can be used to execute code. Yes, the file()
call could be used to access a file that the attacker can control, but
the only use of the $ips array is in checking for banned addresses.
The use of file() is not the same as include() or require().
So - attackers could use this to bypass a ban against their IP address
because they can control the ban file, but that's not the same as
"inclusion."
- Steve
