Re: uhm.. *swallows*.. security thingy?

Hi Zeev! On Tue, 11 Dec 2001, Zeev Suraski wrote: > At 15:23 11/12/2001, Mathieu Kooiman wrote: > >On Tue, 2001-12-11 at 14:04, Zeev Suraski wrote: > >> At 12:36 11/12/2001, Mathieu Kooiman wrote: > >> >On Tue, 2001-12-11 at 11:29, Zeev Suraski wrote: > >> > > Would the cwd of the PHP CGI be inside the user's dir? Did you > >test it in > >> > > a real CGI environment? > >> > > > >> > > Zeev > >> > > >> >Err, PHP CGI would be in /usr/local/bin/php.. > >> > >> Yeah, but that's not what I asked - I asked about the cwd (current > >working > >> directory :) > >> > > > >There are situaties where you have like: > > > >/opt/guide/somesite.com/cgi-bin > >/opt/guide/somesite.com/htdocs > >/opt/guide/somesite.com/logs > > > >cgi-bin and htdocs (2 possible cwds) are under user control. > > Yes, I know :) The big question is whether PHP, when executed by Apache > (as a CGI), starts up in one of these directories, or in Apache's > directory. If it starts in one of these directories - then indeed we have > a problem, because it'll search this directory for the php.ini. If it > starts in Apache's directory, then there's no problem. > [rant++] I don't think it's a problem for a user to make a copy of the php binary somewhere in any of those dirs, where the cwd at runtime is a writeable dir... -- teodor