note 13674 deleted from security.filesystem by jimw
| From: | jimw@php.net | Date: | Wed, 31 Oct 2001 01:35:50 +0000 |
| Subject: | note 13674 deleted from security.filesystem by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-19660@lists.php.net to get a copy of this message | ||
Every security item on PHP I've seen talks about how to prevent scripts from being subverted,
but never about how to prevent a malicious script from (for example) deliberately overwriting
another users' files.
With mod_php it's not possible to change UID, so all scripts have to run as the same UID.
Many scripts have to be able to write files, so you can't easily make PHP run as a very low
privileged user.