Re: Change User on a pconnect
| From: | Michael Samuel | Date: | Sun, 07 Nov 1999 22:58:47 +0000 |
| Subject: | Re: Change User on a pconnect | ||
| References: | 1 2 | Groups: | php.dev |
| Request: | Send a blank email to php-dev+get-12203@lists.php.net to get a copy of this message | ||
On Sat, Nov 06, 1999 at 12:02:14PM -0500, Rasmus Lerdorf wrote:
> Yeah, I was only looking at PHP 3 code where the thing is just an
> integer. I'd like to verify/fix this before 3.0.13 and will get right on
> it after lunch here.
Umm... this is news that it is a security hole?
I'm new on this list, but I just assumed that persistant connections was for
sites that only ran trusted (or verified) scripts.
IMO, working around this is still only a temporary measure; you're better off
documenting it in the php.ini as a potential security risk, and leaving it at
that.
As a semi-safe workaround, have some kind of list associating link identifiers
with script names, and disallowing re-use of the same connection for different
scripts.
Maybe not optimal, but possibly (depending very-much on the situation) more
secure.