Update 46-code_example--RFD_and_file_download_injection_prevention--.md

blabla1337 · Jun 12, 2015 · 95cd7bf · 95cd7bf
1 parent 33f1aa9
commit 95cd7bf
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/...e_examples/php/46-code_example--RFD_and_file_download_injection_prevention--.md b/...e_examples/php/46-code_example--RFD_and_file_download_injection_prevention--.md
@@ -59,6 +59,11 @@
 				header("Pragma: no-cache");    
 				header('Content-Length: ' . filesize($filename));
     				readfile($filename);
+    				/*
+    				Exit is very important, if other mechanims fail this makes sure the rest 
+    				of the page plus attack string does not get downloaded anyways.
+    				*/
+    				exit;
 				}
 			}
 		}
@@ -83,6 +88,11 @@
 				header("Pragma: no-cache");    
 				header('Content-Length: ' . filesize($filename));
     				readfile($filename);
+    				/*
+    				Exit is very important, if other mechanims fail this makes sure the rest 
+    				of the page plus attack string does not get downloaded anyways.
+    				*/
+    				exit;
 			}
 		}
 	}