note 13496 added to security.general.php
| From: | henka at isp dot org dot za | Date: | Tue, 19 Jun 2001 11:47:53 +0000 |
| Subject: | note 13496 added to security.general.php | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-14440@lists.php.net to get a copy of this message | ||
Two approaches with various advantages/disadvantages:
1. Use a combination of open_basedir and disabling certain functions (such as system, passthru,
chmod, is_file (since is_file ignores open_basedir), ...and a ton of other system-level functions)
and modify ext/standard/exec.c to disable backquotes (in function PHP_FUNCTION(shell_exec)) to
include a line RETURN_FALSE; before doing anything else (you can also display an error message - see
existing PHP code). Use this method if you find safe_mode to be too limiting (it is). If you use
VirtualHosts in your apache conf file, then use 'php_admin_value open_basedir
/your/virtual/dir/htdocs' for each site.
OR
2. use safe_mode in /usr/local/lib/php.ini (or wherever your file is stored).
http://www.php.net/manual/en/security.general.php