Re: php3_open_dir not quite restricted
| From: | Rasmus Lerdorf | Date: | Sat, 16 Sep 2000 23:16:21 +0000 |
| Subject: | Re: php3_open_dir not quite restricted | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-17045@lists.php.net to get a copy of this message | ||
You need to turn on safe mode and set open_basedir.
On Sun, 17 Sep 2000, Marcin Orlowski wrote:
>
> hi,
>
> I noticed that even php3_open_dir is specified for particular
> virtual host, one can still do e.g. filesize("/etc/passwd").
> Shouldn't it be rejected like fopen() is? Do PHP4 behave same
> stupid way? If so, how can I work that around? Thanks.
>
> Regards,
> --
> Win95: "We made it safe to turn off your computer"
>
> Marcin
> http://wfmh.org.pl/~carlos/
>
> mailto:carlos@wfmh.org.pl
>
>
>
>