Re: curl_init() is bypassing safe_mode & open_basedir

On Fri, 29 Oct 2004 11:13:33 +0200 (CEST), in php.internals derick@php.net (Derick Rethans) wrote: >Myth: Safe mode makes a PHP installation safe. >Wrong! It might make it a bit safer, but there is always a possibility >to work around it. On the other hand, I think it's a pity not to freshen up code, just because someone turns the argument around: "There is always a possibility to work around it". I think that's the case with the glob()-issue. There is some weirdness with the way that glob() behaves, but there was a reason for adding the safe_mode-check in the first place. There is some inconsistensy in first adding some features with defect safe_mode-aware checks, and not fixing these defects, because safe_mode is a hack. Otherwise, remove safe_mode totally, once and for all. But before safe_mode is politically decided bad and should be removed entirely, one must respect that it is present and part of the system - for better and for worse. By the way, since it's a myth, you might stop repeating the myth, since no-one else bombastically claimed that "Safe mode makes a PHP installation safe" :) -- - Peter Brodersen