note 2414 deleted from Apache module by ronabop
| From: | ronabop@php.net | Date: | Fri, 25 Aug 2000 09:22:00 +0000 |
| Subject: | note 2414 deleted from Apache module by ronabop | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-3203@lists.php.net to get a copy of this message | ||
I'm growing increasingly concerned about the security of using PHP3. As a test, I logged in as
one of my clients, FTP'ed up a test.php3 that simply did this: <? include
"/etc/passwd" ?>
and of course my passwd fine came on screen.. So obviously anyone can read anyone elses stuff.. I
don't like this. Is there any way that I can tell Apache to only allow php3 execution for my
domain and none of my clients? Or can I tell it not to touch anything outside of a specific
directory? The "security" section isn't too helpful.