Edit report at https://bugs.php.net/bug.php?id=5575&edit=1
ID: 5575
Comment by: bill9 at windhome dot com
Reported by: greg at netserv dot net dot au
Summary: open_basedir to ~
Status: Open
Type: Feature/Change Request
Package: *General Issues
Operating System: Linux
PHP Version: 4.0.1pl2
Block user comment: N
Private report: N
New Comment:
You can set it to the equivalent /home/loginid/
But be careful what you wish for, malware php files have access to your whole
folder structure, even if you dont set open_basedir.
open_basedir is a nice safe feature to limit the scope of php scripts
to your file system, ideally to only folders where a misbehaving script can do no
harm.
Previous Comments:
------------------------------------------------------------------------
[2010-08-07 01:37:44] johannes@php.net
This won't make sense in mostconfiguartions, it can be setper vhost in httpd.conf, though.
------------------------------------------------------------------------
[2000-07-14 04:56:20] greg at netserv dot net dot au
is it possible to make open_basedir setable to ~ so the base of the script can be the home directory
of the owner of the script.
I have set it to . so one users cant just do a fopen on another users scripts
This has the side effect that using mutiple directories for a set of scripts is very tricky as the
scripts cant include files from directories next to or below them selves.
I havent fully tested this but it also seems that the restrictions that mean you cant create a file
in safe mode with open_basedir set seem to mean that the tmp_uploads arent possible Is it possible
to make tmp_uploaddir also setable to ~/tmp
or allow tmp_upload to over ride the create restrictions to allow for dynamic tempoary file names.
It seems to me that many people are relying on the security of their phpscripts when another user on
the system can simply read their files useing the common "nobody" permissions
Thanks Greg
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=5575&edit=1