Re: new security related directive for php-4.3.4
| From: | Rasmus Lerdorf | Date: | Fri, 19 Mar 2004 20:43:29 +0000 |
| Subject: | Re: new security related directive for php-4.3.4 | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-8620@lists.php.net to get a copy of this message | ||
On Fri, 19 Mar 2004 boulat@funio.com wrote:
> The reason why I would want to play with settings in php.ini or/and
> httpd.conf often is because everytime I modify those config files I MUST
> restart apache in order for changes to take place, meaning I will have
> DOWNTIME. Now imagine hundreds of new accounts added per day to your
> hosting machine, that means the webserver will end up getting restarted
> hundreds of times... Hundreds of seconds per day add up to minutes of
> downtime... and as we all know downtime is something everyone tries to
> avoid at all costs.
That's a good point. But this implementation still doesn't seem very
slick to me. What about something like:
open_basedir = /var/www/{user}/public_html
Where {user} would map to the owner of the script being executed. Other
things that might be supported as well: {group}, {regex:a.*$}, {host}
and probably other things as well. I haven't thought through this very
much yet, but that seems like a more flexible approach to this problem.
-Rasmus