Re: PHP Hosting
| From: | Richard Lynch | Date: | Mon, 05 Aug 2002 20:11:06 +0000 |
| Subject: | Re: PHP Hosting | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-111263@lists.php.net to get a copy of this message | ||
>If any PHP hosts are out there I have a question:
>
>How do you keep users from erasing / altering files out side of their
>web folder with PHP? Doesn't PHP run in the system user context? Is is
>possible to prevent a user from using PHP to alter anything but in their
>Web folder?
First, PHP runs as the User defined in httpd.conf, which should be 'nobody'
or a similarly under-powered user.
It's true, though, that any files that 'nobody' can erase can also be erased
by PHP...
But they can also be erased by Perl, Ruby, shell scripts, and, well, just
about anything really...
So the problem is in the file's permissions, not that PHP can do the same
things any other program can do.
The preceding all assumes you are using Apache. If you're using IIS you
have much bigger security problems than PHP erasing junk.
--
Like Music? http://l-i-e.com/artists.htm
I'm looking for a PRO QUALITY two-input sound card supported by Linux (any
major distro). Need to record live events (mixed already) to stereo
CD-quality. Soundcard Recommendations?
Software to handle the recording? Don't need fancy mixer stuff. Zero (0)
post-production time. Just raw PCM/WAV/AIFF 16+ bit, 44.1KHz, Stereo
audio-to-disk.