Re: safe mode/open basedir not working ?

That *may* not work as it's a file, not a folder. You're welcome to try, though. :-) On Fri, 2 Jul 2004 14:19:25 -0400, robert mena <robert.mena@gmail.com> wrote: > > Ok. How about set the safe_mode_exec_dir to /dev/null then ? > > > On Wed, 30 Jun 2004 21:55:17 -0700, Justin Patrin <papercrane@gmail.com> wrote: > > > > YES. You need to set the safe_mode_exec_dir path to be some path > > without binaries. Such as: /etc, although that's a bad example. Make a > > directory with only root write access and point that config option to > > it. > > > > > > On Wed, 30 Jun 2004 22:31:27 -0400, robert mena <robert.mena@gmail.com> wrote: > > > > > > Marek, Justin, > > > > > > am I doing something wrong with the setup because I saw the logs and a > > > redeye.php was used to system("perl -xxxx") and was not supposed to. > > > > > > > > > On Thu, 01 Jul 2004 00:32:07 +0200, Marek Kilimajer <lists@kilimajer.net> > > > wrote: > > > > > > > > Justin Patrin wrote --- napísal:: > > > > > On Wed, 30 Jun 2004 23:50:02 +0200, Marek Kilimajer > > > > > <lists@kilimajer.net> wrote: > > > > > > > > > >>robert mena wrote --- napísal:: > > > > >> > > > > >>>Hi, > > > > >>> > > > > >>>I host a few virtual domains in apache 2 and use php. > > > > >>> > > > > >>>The virtual domain is something like > > > > >>> > > > > >>><VirtualHost a.b.c.d:80> > > > > >>> ServerAdmin webmaster@domain.com > > > > >>> DocumentRoot /home/httpd/html/domain.com > > > > >>> ServerName www.domain.com > > > > >>> ErrorLog logs/domain.com-error_log > > > > >>> CustomLog logs/domain.com-access_log combined > > > > >>> ScriptAlias /cgi-bin/ /home/httpd/cgi-bin/ > > > > >>> <Directory /home/httpd/html/domain.com/> > > > > >>> AllowOverride AuthConfig Limit > > > > >>> php_admin_value doc_root > > > > >>> "/home/httpd/html/domain.com/" > > > > >>> php_admin_flag safe_mode on > > > > >>> php_admin_value open_basedir > > > > >>> "/home/httpd/html/domain.com:/tmp/" > > > > >>> </Directory> > > > > >>></VirtualHost> > > > > >>> > > > > >>>Recently I had a minor problem with a user that uploaded via ftp a > > > > >>>php > > > > >>>script in his domain and this domain used exec/system etc to call > > > > >>>perl, read files. > > > > >>> > > > > >>>Shouldn't the settings above retrict such thing ? > > > > >>> > > > > >> > > > > >>no, this setting affects only php, not programs executed from php > > > > > > > > > > > > > > > If you have safe mode on, you can set various things to stop this.. One > > > > > is safe_mode_exec_dir. > > > > > > > > Actualy you have to if you want to use any of the exec functions: > > > > > > > > > > > > > > > > > > > > > > > > > > > -- > > paperCrane --Justin Patrin-- > > > > !DSPAM:40e5a54342181346017871! > > -- DB_DataObject_FormBuilder - The database at your fingertips http://pear.php.net/package/DB_DataObject_FormBuilder paperCrane --Justin Patrin--