Re: PHP6, drop open_basedir?

Hi! > It gives a false sense of safety, and that alone for me is a good > enough reason to remove it. it is not as bad as safe_mode but simply > not good. If you use it right, it does not. Every security feature would give you false sense of safety if you use it wrong - but that alone is not the reason to not have it at all, if it has legitimate uses. IMO open_basedir does. > That being said I have no issue with keeping it besides the lost > opportunity to get rid of an old bad decision. Bad decision was to brand open_basedir as security function that allows defense against attacker with PHP code execution rights. It is obvious we can not deliver on this promise. However, it does not mean that used differently - e.g. as a safeguard in your own code to not access things that you don't want this code to access by mistake - it can not be used. I think it can. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227