Re: PHP6, drop open_basedir?

On 18/06/14 07:29, Pierre Joye wrote: >> Bad decision was to brand open_basedir as security function that allows >> > defense against attacker with PHP code execution rights. It is obvious >> > we can not deliver on this promise. However, it does not mean that used >> > differently - e.g. as a safeguard in your own code to not access things >> > that you don't want this code to access by mistake - it can not be used. >> > I think it can. > This exact example is easily done using system features. > > Anyway, we have different views and that's why I started to this > thread, to know other views :) > > I will still create a RFC to get an official result on that as all the > users I talked to, as well as security people, consider this feature > as a problem. I keep being told 'If you don't like it you don't have to use it' but if you remove something that I like I have little choice. As indicated this is NOT a security feature, but simply a ring fence which DOES pick up silly mistakes like copying code from one branch or site to another without correcting the paths. Something which is difficult to find in the IDE often, but sticks out like a saw thumb in the run level. If you can explain how to provide that ring fence another way then I'd be happy to conciser it, but this does have a use other than some additional magic bullet for security. It simply prevents access cross path where a user does have valid access rights to all of the paths. Given the right wrapper in the deployment it works well ... if you don't like it simply switch it off ... -- Lester Caine - G8HFL ----------------------------- Contact - http://lsces.co.uk/wiki/?page=contact L.S.Caine Electronic Services - http://lsces.co.uk EnquirySolve - http://enquirysolve.com/ Model Engineers Digital Workshop - http://medw.co.uk Rainbow Digital Media - http://rainbowdigitalmedia.co.uk