backticks vs Safe Mode

From: Date: Sun, 24 Nov 2002 12:19:27 +0000
Subject: backticks vs Safe Mode
Groups: php.general 
Request: Send a blank email to php-general+get-125788@lists.php.net to get a copy of this message
I can think of no security reason why you would want to allow anyone to display output from a command, but wouldnt want them to be able to assign that output to a variable. Can someone explain a situation where that would be useful? Arent any security concerns addressed by the safe_mode_exec_dir= directive? Is there any way to get the safety of safe mode without this seemingly backwards rule? [If I was a malicious user with the ability to upload a script, I certainly wouldnt be at all hindered by being unable to have the script itself parse the output- I'd get a seperate script to do that for me and POST the results back to the server's script just as fast.] {The intent of this message is to find a way to circumvent this idiocy, to be noticed by a developer who will go "oops, did we leave that idiocy in?" or to be presented with an explanation for what is seemingly, idiocy. }

« previous php.general (#125788) next »