RE: [PHP] Security Question

On 20 February 2004 22:29, Ed Lazor wrote: > PHP include statements default to the current directory. If > the path to > my PHP files is /home/osmosis/public_html, why would users visiting my > site occasionally get an error that the include file wasn't found in > /home/budguy/public_html? > > It's like PHP is somehow confused and running my script with > the account > settings (and permissions, possibly) for another user on my host > provider's server. If that's true, wouldn't this quality as > a security > issue? > > They use open_basedir for security. Isn't that part of PHP? They're > running the latest version of PHP (4.3.4). This looks like http://bugs.php.net/bug.php?id=25753 to me, which has only recently been marked as fixed and I don't believe has made it into an official release yet. Cheers! Mike --------------------------------------------------------------------- Mike Ford, Electronic Information Services Adviser, Learning Support Services, Learning & Information Services, JG125, James Graham Building, Leeds Metropolitan University, Beckett Park, LEEDS, LS6 3QS, United Kingdom Email: m.ford@leedsmet.ac.uk Tel: +44 113 283 2600 extn 4730 Fax: +44 113 283 3211