Toggling enable_dl API off for runtime?

From: Date: Thu, 31 May 2007 20:36:24 +0000
Subject: Toggling enable_dl API off for runtime?
Groups: php.internals 
Request: Send a blank email to internals+get-30007@lists.php.net to get a copy of this message
In httpd server (and most) there is a startup phase, when we generally trust what the admin has done, and a runtime phase. There are obvious exploits if untrusted scripts can run arbitrary dlload's after startup. enable_dl in php.ini will obviously override this, but to start up and load dynamic extensions, it's initially required to be on. Is there any sense in having php4apache2 (and other SAPI's) permitted to run the entire startup phase of php prior to turning enable_dl back off for the runtime phase of the server?

« previous php.internals (#30007) next »