Re: Bug #1527: Apache module, safe mode enabled, touch() function

> Problem: Running Apache 1.3.6 with php module compiled in, safe mode is enabled (httpd.conf > contains line: php3_safe_mode On). > > The .php3 file reads thus (plus some HTML lines): > > <?php > echo touch("/home/users/myid/testfiles/junk.txt"); > ?> > > When executed via Apache php3 module, the above script prints "1" and CREATES the > file junk.txt. Apache is running as userid "myid" but the script belongs to another login. > Attempts to use functions such as "file()" correctly (as I understand the documentation of > safe mode) report: > === > Warning: SAFE MODE Restriction in effect. The script whose uid is 7921 is not allowed to access > /home/users/myid/testfiles/files.txt owned by uid 7917 in > /home/users/otherid/public_html/php/test.php3 on line 9 > === > when the script is: > > <?php > $file = file("/home/users/myid/testfiles/files.txt"); > for ($i = 1; $i <= count($file); $i++) { > echo $file[$i]; > } > ?> > > I understood that all file i/o functions in safe mode disallowed access to files other than > those owned by the same login as the script being executed. The touch() function appears to disobey > this rule. When creating a file, the thing safe mode looks at is the owner of the directory in which the file is being created. If /home/users/myid/testfiles/ is owned by the same user that is running the touch script, it correctly allows the script to create the file. Is that the case for you? -Rasmus