Re: Create .php file with php [POC CODE INCLUDED]
| From: | Crayon Shin Chan | Date: | Tue, 26 Jun 2007 20:31:30 +0000 |
| Subject: | Re: Create .php file with php [POC CODE INCLUDED] | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-257811@lists.php.net to get a copy of this message | ||
On Wednesday 27 June 2007 03:53, Daniel Brown wrote:
> On 6/26/07, Al Rider <alan@ridersite.org> wrote:
> > I think most systems have a /tmp directory above the web dir, so
> > outsiders can't watch it anyhow.
>
> True, but on an unsecured box, this becomes possible, as Apache
> will most likely be running universally as
nobody,
>httpd,
> apache, or daemon for all
> scripts, including all web-based scripts
> writing to the /tmp directory. This includes session information,
> temporary .php files (as Marius requested), et cetera.
How is this different from:
"put them in a specific directory that only the web server has access to
read, write, and execute"
--
Crayon