Re: How unsafe is register_globals?

On Thu, Jul 17, 2003 at 01:56:57PM +0800, Jason Wong wrote: > > > > gets the error "php_flag not allowed here". I see from the comments at > > http://www.php.net/register_globals that I need > > AllowOverride Options to > > make that function ... but is it possible to have fine-grained enough an > > AllowOverride statement that only register_globals can be changed? > > > > I wouldn't want a user to use his .htaccess file to turn off safe_mode > > or open_basedir. > > Take control of the setting yourself by setting it httpd.conf, inside the > container of the virtual host in question. Not so easy with mod_vhost_alias, given that I want it to apply only to certain users, and possibly only for directories for those users. The .htaccess solution is the right one unless "AllowOverride Options" allowed the user to turn off safe_mode and open_basedir. I don't have a non-production machine to test it on at the moment. Any idea how I give the user local register_globals control without also letting them alter the other php.ini options? -- Paul Chvostek <paul@it.ca> Operations / Abuse / Whatever it.canada, hosting and development http://www.it.ca/