note 25081 added to features.safe-mode

Some paranoid web managers also restrict the set_user_abort() function. This constitutes a security issue for hosted web sites, because the hosted script cannot guarantee safe atomic operations on files in a reasonnable time (the time limit may still be in effect): If set_user_abort() is disabled by the web admin, a user can corrupt the files of a hosted web site by simply sending many requests to the PHP script, and aborting it fast. In some cases that can be easily reproduced after a dozen of attempts, the script will be interrupted in the middle of a file or database update! The only way for the hosted web site to protect itself in this case is to use a sleep() with a random but not null short time before performing atomic operations. Web admins should then definitely NOT disable the set_user_abort() function which is vital to ensure atomic operations on hosted critical files or databases. Instead they should only disable the set_time_limit() function, and set a constant but reasonnable time for any script to complete their atomic operations. -- http://www.php.net/manual/en/features.safe-mode.php http://master.php.net/manage/user-notes.php?action=edit+25081 http://master.php.net/manage/user-notes.php?action=delete+25081 http://master.php.net/manage/user-notes.php?action=reject+25081