Re: safe mode/open basedir not working ?

Justin Patrin wrote --- napísal::

On Wed, 30 Jun 2004 23:50:02 +0200, Marek Kilimajer <lists@kilimajer.net> wrote:

robert mena wrote --- napísal::

Hi, I host a few virtual domains in apache 2 and use php. The virtual domain is something like <VirtualHost a.b.c.d:80>

       ServerAdmin webmaster@domain.com
       DocumentRoot /home/httpd/html/domain.com
       ServerName www.domain.com
       ErrorLog   logs/domain.com-error_log
       CustomLog  logs/domain.com-access_log combined
       ScriptAlias /cgi-bin/ /home/httpd/cgi-bin/
       <Directory /home/httpd/html/domain.com/>
               AllowOverride AuthConfig Limit
               php_admin_value doc_root "/home/httpd/html/domain.com/"
               php_admin_flag safe_mode on
               php_admin_value open_basedir "/home/httpd/html/domain.com:/tmp/"
       </Directory>

</VirtualHost> Recently I had a minor problem with a user that uploaded via ftp a php script in his domain and this domain used exec/system etc to call perl, read files. Shouldn't the settings above retrict such thing ?

no, this setting affects only php, not programs executed from php

If you have safe mode on, you can set various things to stop this. One is safe_mode_exec_dir.

Actualy you have to if you want to use any of the exec functions: