Re: Re: safe_mode redesign

ZS>> My point is that with safe_mode, $x = file("/etc/passwd") can probably ZS>> still be achieved, only perhaps not that easily. The false sense of ZS>> security that it gives you may (will) cause administrators to set their ZS>> servers up in an insecure way. Here I wonder, why it is impossible to define some set of safe mode security guidelines, and make all functions conform to it? After all, mostly everything (except, probably, some extensions like COM when you never know) is controlled by the engine, why isn't it possible to have it to adhere to some set of guidelines? Also, if the guidelines would really be defined and documented, the sysadmins would know what it actually does and what it does not, not basing on the word "safe" alone. -- Stanislav Malyshev, Zend Products Engineer stas@zend.com http://www.zend.com/ +972-3-6139665 ext.115