note 35863 added to features.safe-mode

gtg782a: forcing PHP-created files to be owned by the same owner/group as the script that created them would require root priviledges, which apache normally doesn't have, or create a race condition if chown() is used (which even may not work in every environment, e.g. if quotas are in place). Using open_basedir avoids using these files to escalate priviledges, but still you'd be able to write files with apache's uid, which is another bad thing if quotas are in place. A possible solution to this problem may be the patch I wrote (available at http://andy.rz.uni-karlsruhe.de/~andy/source/Patches/php-4.3.3/, against PHP 4.3.3 but should apply to other versions, too) which enforces the uid of the process execution the PHP-script and the uid of the directory where a new file should be created to be the same. ---- Manual Page -- http://www.php.net/manual/en/features.safe-mode.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+35863 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+35863&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+35863&report=yes