note 13674 added to security.filesystem.php
| From: | rpb at community dot net dot uk | Date: | Thu, 28 Jun 2001 14:08:37 +0000 |
| Subject: | note 13674 added to security.filesystem.php | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-14717@lists.php.net to get a copy of this message | ||
Every security item on PHP I've seen talks about how to prevent scripts from being subverted,
but never about how to prevent a malicious script from (for example) deliberately overwriting
another users' files.
With mod_php it's not possible to change UID, so all scripts have to run as the same UID.
Many scripts have to be able to write files, so you can't easily make PHP run as a very low
privileged user.
http://www.php.net/manual/en/security.filesystem.php