Looking at the code of Joomla I see that in the first line of the index, it defines the base path of installation with dirname(__FILE__).
Is this a possible risk for the site? If a non controlled error message show the internal path of the Joomla directory, because of, for example a failed include, can it be used to perform some kind of attack to the site? If yes, is it convenient to use this function?
1
You shouldn’t show the PHP error messages to users in the first place. So no, it’s not a risk.
Also, if the only safety measure on the server is to hide the path where the source code is located, then… well… you should be more concerned by other risks then showing the path to the users.
Finally, by using relative paths, you’re potentially introducing more security holes. See for example Preventing Directory Traversal in PHP but allowing paths.
1
__FILE__ is a native global variable that holds the path of the script that’s being executed, and dirname(__FILE__) will return the directory part of that path. There’s absolutely no way this will fail, if the path in __FILE__ doesn’t exist or is invalid, you couldn’t have called the script in the first place anyway.
Generally speaking you shouldn’t let any PHP errors (including warnings and notices) reach the user, read up on error_reporting and display_errors.
1
Use in __DIR__ PHP >= 5.3 and dirname(__FILE__) otherwise.
Because both give the same output but __DIR__ is evaluated at compile-time and is (or, should be) faster. dirname(__FILE__) means a function-call which is evaluated at execution-time.
var_dump(__DIR__);
var_dump(dirname(__FILE__));
As explained in https://stackoverflow.com/a/2749423/2010598