Re: open_basedir_for_include
| From: | Ilia Alshanetsky | Date: | Sun, 26 Mar 2006 17:42:57 +0000 |
| Subject: | Re: open_basedir_for_include | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-22586@lists.php.net to get a copy of this message | ||
If you don't trust your users to execute external commands, which is perfectly valid concern, PHP provides you with a way (disable_functions) INI setting to restrict the functionality.
Ilia
Peter Brodersen wrote:
On Sat, 25 Mar 2006 12:14:52 -0500, in php.internals ilia@prohost.org (Ilia Alshanetsky) wrote:Plus is you leave the file writable, what's to say you couldn't do: shell_exec("cp foo /lib/file/inc.php") ?The possible exec restriction salvaged from safe_mode mentioned in <43874C56.8050007@lerdorf.com> ? This thread is mainly about a safety net for one's own code. But regarding restricting users, open_basedir is IMO useless if not backed up by some other methods (like restricting exec functions).