Req #37745 [Com]: Include exec_dir patch in PHP distribution
Edit report at https://bugs.php.net/bug.php?id=37745&edit=1
ID: 37745
Comment by: spam2 at rhsoft dot net
Reported by: phpbugs at aa-works dot de
Summary: Include exec_dir patch in PHP distribution
Status: Wont fix
Type: Feature/Change Request
Package: Program Execution
Operating System: n/a
PHP Version: 5.1.4
Block user comment: N
Private report: N
New Comment:
by list exec() and friends in disabled_functions like everybody qualified to host customers did the
last 15 years - allowing whatever binary outside php to get called while talking about folder
restrictions is naive - once that thing is started it can call exec() itself and is no longer bound
to any php restrictions and that is why safe_mode was dumb from the begin especially that it
enforced files to be write able by the Webserver
others have a chrooted httpd instance per customer on a different port than 80 and a common reverse
proxy in front and these days you have containers and virtualization too
Previous Comments:
------------------------------------------------------------------------
[2017-07-25 00:26:48] johannes@php.net
We don't have safe_mode anymore.
------------------------------------------------------------------------
[2012-04-20 12:54:50] php at cabillot dot eu
To the php team : what do you think about this feature ?
Now that safe_mode is disabled, how hosting companies can protect consumers from
themselves ?
------------------------------------------------------------------------
[2006-06-08 13:28:53] phpbugs at aa-works dot de
Description:
------------
PHP allows to be configured to only execute programs (with exec() type of functions) which are
contained in a certain directory while running in safe mode.
There is no such configuration option for PHP not running in safe mode in the main PHP distribution
but a patch to add that feature exists:
http://kyberdigi.cz/projects/execdir/english.html
Reproduce code:
---------------
n/a
Expected result:
----------------
exec_dir configuration directive being available
Actual result:
--------------
it isn't yet
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=37745&edit=1
Thread (4 messages)