Re: why the damn phpinfo() is so talkative?

Jason Greene wrote: > I agree with what your saying, though I do agree that > hosted customers seeing certain environment variables > can be undesireable. What do you think about a safe mode > ini setting that could block certain "sensative" vars > from being read? This adds little, as these variables are still part of the environment and may be read with other means such as external programs, other CGI programs or sloppily programmed PHP extensions.. The secure solution is not to put these variables into the environment in the first place, by properly setting up an Apache start script and using this script, and only this script, to start the Apache web server. The code in suexec pruning the environment for CGI programs may be a good start for such a list of environment variables. Kristian -- Kristian Köhntopp, NetUSE AG Siemenswall, D-24107 Kiel Tel: +49 431 386 436 00, Fax: +49 431 386 435 99 Using PHP3? See our web development library at http://phplib.netuse.de/