PHP6, drop open_basedir?
| From: | Pierre Joye | Date: | Tue, 17 Jun 2014 08:26:32 +0000 |
| Subject: | PHP6, drop open_basedir? | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-74932@lists.php.net to get a copy of this message | ||
hi,
One of the last reminding so called "security" feature is open_basedir.
On Windows f.e. it is very easy to create application pool with the
right users/permissions settings (IIS) or only permissions settings
(Apache). It is not possible to create one user per host on Apache
using mod_php but I think it is acceptable as it is mostly used as
development server or dedicated apps.
On linux, fcgi/fpm with linux permissions systems allow pretty much
the same. And my solutions exist for a per user/application isolation
system.
I think it is not worth the effort to keep maintaining something that
will never be as safe as system level permissions.
What do you think about removing it in php 6? Thoughts?
Cheers,
--
Pierre
@pierrejoye | http://www.libgd.org