RE: [PHP] Restrict uploaded scripts
| From: | Mathias Bundgaard Svesson | Date: | Sat, 10 Jun 2006 11:39:20 +0000 |
| Subject: | RE: [PHP] Restrict uploaded scripts | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-237736@lists.php.net to get a copy of this message | ||
Would it then be posible to restrict it in some other way, for example
using chroot? Or do I just have to make sure that the modules come from
a source that I trust or look through the code?
fre, 09 06 2006 kl. 10:47 -0400, skrev Jim Moseby:
> >
> > Wouldn't it even be posible, if the script couldn't be run
> > directly, but
> > had to be run through require or something like that?
> >
>
> Require just includes the code inline. It still runs on the webserver as
> the server user as if it were one big script. I think you would have to
> sanitize the uploaded code before allowing it to run. Writing the
> sanitation algorithm to perform such a task would be a nightmare.
>
> JM