Bug->Req #77190 [Asn]: PHP_VALUE can be changed by PHP-FPM environment variables without checking

Edit report at https://bugs.php.net/bug.php?id=77190&edit=1 ID: 77190 Updated by: bukka@php.net Reported by: ricterzheng at gmail dot com Summary: PHP_VALUE can be changed by PHP-FPM environment variables without checking Status: Assigned -Type: Bug +Type: Feature/Change Request Package: FPM related Operating System: Linux PHP Version: 7.0Git-2018-11-23 (snap) Assigned To: bukka Block user comment: N Private report: N New Comment: This behaviour is on purpose and its mitigation (optional disabling) is treated as a feature. Previous Comments: ------------------------------------------------------------------------ [2021-07-12 16:11:22] cmb@php.net Related To: Bug #64103 ------------------------------------------------------------------------ [2021-07-12 16:08:08] cmb@php.net > I think you should read this as open_basedir is not really a > security measure: Right, see also <https://externals.io/message/105606> and <https://externals.io/message/115406>. > So I don't think this have to be managed as a security bug. ACK. ------------------------------------------------------------------------ [2020-07-16 12:56:55] remi@php.net Having FPM listening on a public address seems a configuration issue, with a lot of security-related issues. The reason one by default, FPM only allow local client (network port) or restricted user list (NDS). So I don't think this have to be managed as a security bug. ------------------------------------------------------------------------ [2020-07-14 12:44:25] cmb@php.net Since this is a PHP-FPM issue, it does certainly not affect Windows. ------------------------------------------------------------------------ [2020-03-27 09:22:19] cmb@php.net Related To: Bug #79417 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=77190 -- Edit this bug report at https://bugs.php.net/bug.php?id=77190&edit=1