g1smd
msg:4499448 | 7:48 pm on Sep 24, 2012 (gmt 0) |
It apparently strips the query string if it begins with a space and then a hyphen and does not contain an equals sign.
It's coded as an internal rewrite, stripping those parameters before passing the query around inside the server.
The lack of a slash before the $1 leaves your server wide open to hacking by path injection.
Here's an object lesson in commenting your code so you know what it is supposed to do, months and years later. :)
|
leemon
msg:4499449 | 7:56 pm on Sep 24, 2012 (gmt 0) |
Thanks! My site got hacked a few months ago. Then, this is probably a remnant of that hack.
|
g1smd
msg:4499452 | 8:07 pm on Sep 24, 2012 (gmt 0) |
I'd say it was an attempt to protect against some sort of hack (except for someone accidentally leaving out the slash).
|
|
