This is why it's long been the standard that the attachments repository be located outside the webroot. As a temporary measure, it's best to disable the PHP interpreter altogether for the attachments directory. This means that no matter what extension a file is masqueraded as, the PHP executable will not parse it.
03-05-2012, 05:51 AM
Threaded Mode