#22410 [Bgs->Opn]: broader apache-php security options

ID: 22410 User updated by: greg at laundrymat dot tv Reported By: greg at laundrymat dot tv -Status: Bogus +Status: Open Bug Type: Feature/Change Request Operating System: redhat 7.0 PHP Version: 4.3.0 New Comment: Why is it so impossible? Just allow certain functions like the ticker command to be turned off for a virtual server. I got into a shared server yesterday that turned off the system and the exec commands system wide, but I was still able to execute the ticker command. That’s bad. There has to be a way to prohibit these commands for virtual directories. You can't use disable_functions on a per-dir basis because it is impossible to implement in an efficient manner. You should make this work: php_admin_value disable_functions "system,exec,`" Try this in safe mode: $test=ls -la; print $test; If you cold make the open_basedir command work with the system,exec and ticker commands that would sove the problem too. I just don’t want people to see anything past their root directories, while I need full access to call binaries. Thanks Greg Previous Comments: ------------------------------------------------------------------------ [2003-04-30 11:41:13] rasmus@php.net You can't use disable_functions on a per-dir basis because it is impossible to implement in an efficient manner. safe_mode already addresses this issue with its safe_mode_exec() dir. I am sorry if you feel this is too restrictive, but there is simply no way to make open_basedir restrictions apply to arbitrary scripts a user might run. Use safe-mode or set up a jailed configuration with individual instances of Apache listening on separate ports with a reverse proxy out front directing port 80 requests to the appropriate internal port. ------------------------------------------------------------------------ [2003-04-30 11:26:23] wez@php.net Tried: php_admin_value disable_functions "system,exec" On a per directory basis? ------------------------------------------------------------------------ [2003-04-30 11:20:20] greg at laundrymat dot tv Will someone please address this security issue. It's huge! ------------------------------------------------------------------------ [2003-02-25 03:05:43] greg at laundrymat dot tv I really think there needs to be a way to prohibit system() ticker, or exec() on a per directory basis via the apache conf file. Safe mode is too restrictive and open_basedir doesn't work with these commands. Either make open base_dir actually work on all functions or create a way to shut these functions or any fuction off on a per directory basis. Its really is a must. I have a site that gives clients ftp access, A script could read the majority of the files on my server using the ticker and the vi commands. Thanks Greg Greenhaw ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=22410&edit=1