From: maddog2k@maddog2k.nl
Operating system: Linux/FreeBSD
PHP version: 4.0.6
PHP Bug Type: Feature/Change Request
Bug description: 'admin-values' php.ini also for CGI-binary
The problem I ran into while using PHP as CGI-binary under for example
Apache instead of mod_php, is that you can't simply allow restrictive
overrides of certain values.
If you for example put a 'php.ini' file in a directory, PHP will read that
file...completely ignoring the /usr/local/lib/php.ini
Let's say we have a malicious user who wants to upload files of 100MB, he
could simply do that by allowing this in his 'own' php.ini (post_max_size).
I don't think this is a wanted situation.
The restriction I'm using now (thanks to Mathieu), is by an edited
php_ini.c that reads only the php.ini from PHP_CONFIG_FILE_PATH.
Why not using the same guidelines as with the ini_set() function ? Or an
option in the 'default' .ini, to turn this behaviour on...:))
--
Edit bug report at: http://bugs.php.net/?id=14071&edit=1