note 13496 deleted from security.general by jimw
| From: | jimw@php.net | Date: | Wed, 31 Oct 2001 01:39:13 +0000 |
| Subject: | note 13496 deleted from security.general by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-19680@lists.php.net to get a copy of this message | ||
Two approaches with various advantages/disadvantages:
1. Use a combination of open_basedir and disabling certain functions (such as system, passthru,
chmod, is_file (since is_file ignores open_basedir), ...and a ton of other system-level functions)
and modify ext/standard/exec.c to disable backquotes (in function PHP_FUNCTION(shell_exec)) to
include a line RETURN_FALSE; before doing anything else (you can also display an error message - see
existing PHP code). Use this method if you find safe_mode to be too limiting (it is). If you use
VirtualHosts in your apache conf file, then use 'php_admin_value open_basedir
/your/virtual/dir/htdocs' for each site.
OR
2. use safe_mode in /usr/local/lib/php.ini (or wherever your file is stored).