RE: [PHP] safe mode
| From: | Kim Madsen | Date: | Fri, 29 Jul 2005 07:47:54 +0000 |
| Subject: | RE: [PHP] safe mode | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-219580@lists.php.net to get a copy of this message | ||
> -----Original Message-----
> From: Bostjan Skufca @ domenca.com [mailto:bostjan.skufca@domenca.com]
> Sent: Thursday, July 28, 2005 1:38 PM
> > > I would *never* host anything on a server with safe_mode on!
>
> What are your reasons for this decision?
I correted it in a mail 5 minutes after.
With safe_mode off this is possible
System("cat /home/Bostjan/include/db_setup.inc");
From any php script and any user.
One should be protected by safe_mode_gid and safe_mode_include_dir, but I´ve seen several examples
of hosting setups that allows complete access to another users directory. With safe_mode on I´M
more safe and so are my customers ;-)
--
Med venlig hilsen / best regards
ComX Networks A/S
Kim Madsen
Systemudvikler/Systemdeveloper