Re: new security related directive for php-4.3.4
| From: | Ilia Alshanetsky | Date: | Fri, 19 Mar 2004 23:18:58 +0000 |
| Subject: | Re: new security related directive for php-4.3.4 | ||
| References: | 1 2 3 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-8634@lists.php.net to get a copy of this message | ||
On March 19, 2004 05:42 pm, boulat@funio.com wrote:
> So just because there might be means to bypass security options in PHP we
> shouldnt even bother improving security? Lets give up.
The issue is not the fact that these setting can be bypassed by PHP, those are
bugs to be fixed. But the fact since the settings are PHP specific, other
scripting languages (mod_perl|python) and CGI could be used to do actions
restrictred from PHP. The real solution is in the webserver not a scripting
language that is being run from inside the webserver.
Ilia