Re: PHP6, drop open_basedir?

On Wed, Jun 18, 2014 at 5:49 AM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote: > I think you have a very narrow view of how this feature is used. > Security and code quality is about layers. This is a useful layer that > helps verify that an application, or even a subset of an application, is > only able to access a given set of directories. If something tries to > access a file outside of the defined scope, we get an error and we know > there is a bug in the code. I, and many companies out there, rely quite > heavily on this feature to catch mistakes. And yes, there are ways of > getting around it at the PHP-level if you deliberately craft your PHP > code to do so, but that doesn't make the feature any less useful to all > the people using it to catch non-deliberate mistakes. It gives a false sense of safety, and that alone for me is a good enough reason to remove it. it is not as bad as safe_mode but simply not good. That being said I have no issue with keeping it besides the lost opportunity to get rid of an old bad decision. Cheers, -- Pierre @pierrejoye | http://www.libgd.org