note 27085 rejected from function.system by nicos
| From: | nicos@php.net | Date: | Fri, 22 Nov 2002 12:10:33 +0000 |
| Subject: | note 27085 rejected from function.system by nicos | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-39858@lists.php.net to get a copy of this message | ||
When having users allowed to run php scripts I found that the webserver being able to read the
home-directorys, it allows users to run commands like system("cat
/home/auser/connectdb.inc"); as the webserver, thus, all users being able to run scripts can
browse eachothers home-directories and finding database-passwords.. how do i get around this?