note 66116 added to features.safe-mode.functions

all file-handling and -management functions are restricted, just in case someones wondering why they're not listed here. a script can run these functions on files without errors, if the files were created (are owned) by the same UID, the script was created (is owned) by. example: you upload a script, it is owned by UID 720. you upload a picture, it is owned by UID 720. the script creates a thumbnail of the picture. the thumb is owned by UID 30 (the server/apache). this makes it impossible (?) to run a gallery script, which checks for newly uploaded pictures in order to create and display thumbs of them if you want to check, if a thumbnail already exists. the script would be owned by UID 720, the thumb by UID 30. you could upload a script which creates a file (e.g. from a text file) with .php ending. this script would be owned by UID 30 and could access the thumbs, but it couldnt read the upload pictures. <? $data = fread(fopen("test.txt", "r"), filesize("test.txt")); $file = "test.php"; if (!$file_handle = fopen($file,"a")) { echo "Cannot open file"; } if (!fwrite($file_handle, $data)) { echo "Cannot write to file"; } fclose($file_handle); chmod("test.php", 0777); ?> ---- Server IP: 217.13.201.10 Probable Submitter: 84.140.234.67 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/features.safe-mode.functions.php Edit -- http://master.php.net/note/edit/66116 Del: integrated -- http://master.php.net/note/delete/66116/integrated Del: useless -- http://master.php.net/note/delete/66116/useless Del: bad code -- http://master.php.net/note/delete/66116/bad+code Del: spam -- http://master.php.net/note/delete/66116/spam Del: non-english -- http://master.php.net/note/delete/66116/non-english Del: in docs -- http://master.php.net/note/delete/66116/in+docs Del: other reasons-- http://master.php.net/note/delete/66116 Reject -- http://master.php.net/note/reject/66116 Search -- http://master.php.net/manage/user-notes.php