#44520 [Opn->Bgs]: PHP does not have an option of the folders' access prohibition in "php.ini"

ID: 44520 Updated by: johannes@php.net Reported By: nspu at list dot ru -Status: Open +Status: Bogus Bug Type: Feature/Change Request Operating System: Microsoft Windows 2000 SP4 PHP Version: 5.3CVS-2008-03-24 (CVS) New Comment: Access should be controlled by the operating system, not PHP. Anyways: There's open_basedir which was made for this. See docs. Previous Comments: ------------------------------------------------------------------------ [2008-03-24 20:00:55] nspu at list dot ru Description: ------------ PHP has no prohibition of the folders' access for the scripts in Microsoft Windows 2000, so, the script can get access to any file or folder on any logical disk. It would be better, if the file "php.ini" had the option to prohibit any access (read/write/delete/rename, etc.) for the PHP scripts for the pointed out folders. For example: ; the scripts will never get access to files and sub-folders of the ; following folders: prohibited_folders = "C:\Program Files","C:\WINNT","D:\" Or something like this... Expected result: ---------------- Using the option "prohibited_folders" (or something like this), it is expected not to give the access to the pointed out folders and to their all sub-folders for the PHP scripts in the Microsoft Windows platforms. For example, pointing "C:\WINNT" is expected to prohibit the access to the following folders: "C:\WINNT", "C:\WINNT\system", "C:\WINNT\system32", "C:\WINNT\system32\drivers", etc... Actual result: -------------- Now, PHP is still having some "holes" in its safety system. One of them is the free access to any file or folder in the Microsoft Windows platforms. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=44520&edit=1