Re: dangerous handling of security bugs

Hello, On 2010.07.13. 15:24, Reindl Harald wrote:

- php6 is dead as of now

This was not so as i wrote the bugreport and is not related RTFM is the wrong answer to a bug, every time, every where

- open_basedir is not per directory, except if the new setting is more - restrictive that the system one. As documented.

Again what will you try me to say? Are you not willing to understand that or du you really not understand? a) open_basedir PHP_INI_ALL b) My setting WAS more restrictive c) This was not the problem The problem was if you called vhost1 you got error messages that his scripts are not in the basedir of vhost2, after reload with some luck it worked and finally php took ANY RANDOM basedir from another vhost. So why in the world are you talking so much stuff before you try to understand what i desciribed more than once very clear?

First of all, excuse me to say, but your English is horrible and I'm also questioning your reading comprehension skills. Yes, it's rude, but I'm betting you would have avoided these frustrating mail exchanges had you had a better understanding of said manual. (And Apache documentation too.) Second of all, when you are using mod_php, then every server process uses the same configuration, because even if you state php_admin_value inside a VirtualHost directive, Apache just passes it to the loaded module. Yes, it's not ideal, I know. Please use suExec to secure your server environment. http://www.brandonturner.net/blog/2009/07/fastcgi_with_php_opcode_cache/ Also try jailing (chroot) it's even more secure. (And this post looks outdated, but the concept isn't.) http://e.metaclarity.org/268/httpdsuexecchrootfastcgiphp/ To symlink certain directories into the chrooted environment you can use "mount -o bind " see: http://www.linuxquestions.org/questions/linux-newbie-8/symlinks-working- from-inside-chroot-to-outside-604885/ Sincerely, Pas

should i draw you a picture about it? Are you too proud to say "yes it was a real mistake!"? These days this is more realxed because you can make a comment to a closed bugreport, some times ago you had no change to make clear the problem but this does not change the bad attitude from closing everything like a cowboy and wonder why people are pissed off Am 13.07.2010 15:00, schrieb Pierre Joye:

Then show me where it is documentated that php6 takes a random configuration for vhost-settings? <VirtualHost *> DocumentRoot /var/www/docroot1 ServerName docroot1 <Directory "/var/www/docroot1"> php_admin_value open_basedir "/var/www/docroot1" </Directory> </VirtualHost> <VirtualHost *> DocumentRoot /var/www/docroot2 ServerName docroot2 <Directory "/var/www/docroot2"> php_admin_value open_basedir "/var/www/docroot2" </Directory> </VirtualHost> Come on, show me the part of rtfm where it is described that if you call "http://docroot1/" php is throwing a error that the files are not in "/var/www/docroot2" per random in both directions and with every reload you can have luck and it matches! And after such actions you wonder why someone is stopping testing snaphots? really?

Let me summarize: - php6 is dead as of now - open_basedir is not per directory, except if the new setting is more - restrictive that the system one. As documented.