Question

I try to read Claroline source code to learn from their coding.
In index.php file, at the first line of code, they write

unset($includePath); // prevent hacking

You can see full claroline source code from here.

They commented that the line is used to prevent hacking..
I have no idea why should they unset $includePath while the variable is never defined before that line..

What is the purpose of that line of code do actually, and what hacking type that they means?

Answer 1

I have not looked at the source myself, but a bit of searches gives the following kind of security advisory :

Claroline mambo.inc.php and postnuke.inc.php "includePath" file include

Note that this relies on [**`register_globals`**][2] being enabled, which :

• is not the default : it’s been disabled by default for a very long time (since PHP 4.2.0)
• is bad practice (unsafe ^^ as it allows anyone to inject variables into the PHP scripts ; which is why this one, in this case, is unset "to prevent hacking" )