#34793 [Opn->Csd]: php-cli searches php.ini from current dir which can be abused

ID: 34793 Updated by: bjori@php.net Reported By: glen at delfi dot ee -Status: Open +Status: Closed Bug Type: Feature/Change Request Operating System: PLD Linux PHP Version: 5.1.0RC1 -Assigned To: +Assigned To: edink New Comment: Thank you for your bug report. This issue has already been fixed in the latest released version of PHP, which you can download at http://www.php.net/downloads.php :) Previous Comments: ------------------------------------------------------------------------ [2006-11-02 23:36:53] glen at delfi dot ee you should close this bug with message like "RESOLVED in 5.2.0" ------------------------------------------------------------------------ [2006-01-17 15:49:05] glen at delfi dot ee to put this into another light. how should i run php cli program, with *not* reading ./php.ini? a real live situation: i have a PHP program defined as CVS loginfo handler. CVS server accessed via ssh. now if i happen to commit php.ini in such CVS setup, the php.ini is first uploaded to cvs server and then a PHP program is executed in that directory (where commited files were uploaded). as the php.ini is not for the OS where the PHP program is ran. i get fatal error from PHP interpreter and no code is executed: # cvs ci -m '- disable zend, broken' php.ini Checking in php.ini; /usr/local/cvs/sw/apache/php.ini,v <-- php.ini new revision: 1.7; previous revision: 1.6 done PHP Warning: PHP Startup: Unable to load dynamic library './pcre.so' - ./pcre.so: cannot open shared object file: No such file or directory in Unknown on line 0 PHP Warning: Unknown: failed to open stream: No such file or directory in Unknown on line 0 PHP Warning: Unknown: Failed opening '/www/vars.inc' for inclusion (include_path='.:/usr/share/pear') in Unknown on line 0 ------------------------------------------------------------------------ [2005-10-10 00:06:59] adamg at agmk dot net I believe this behaviour is wrong and PHP should be fixed not to look for php.ini in the current directory for the reasons described by glen. Ideally (as I see it) is a fixed location in /etc and (optionally) in home dir of user running the script. Why do you think this bug report is bogus? What are the reasons for keeping such behaviour? ------------------------------------------------------------------------ [2005-10-10 00:05:36] glen at delfi dot ee in fact i know that documentation says so. but that doesn't mean it supposed to be like this? can't you at least consider securing it, by adding some option to enable/disable this? so i changed category to feature request! ------------------------------------------------------------------------ [2005-10-09 19:14:38] sniper@php.net Thank you for taking the time to write to us, but this is not a bug. Please double-check the documentation available at http://www.php.net/manual/ and the instructions on how to report a bug at http://bugs.php.net/how-to-report.php ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/34793 -- Edit this bug report at http://bugs.php.net/?id=34793&edit=1