note 35863 rejected from features.safe-mode by didou

Note Submitter: Andreas.Ley@rz.uni-karlsruhe.de ---- gtg782a: forcing PHP-created files to be owned by the same owner/group as the script that created them would require root priviledges, which apache normally doesn't have, or create a race condition if chown() is used (which even may not work in every environment, e.g. if quotas are in place). Using open_basedir avoids using these files to escalate priviledges, but still you'd be able to write files with apache's uid, which is another bad thing if quotas are in place. A possible solution to this problem may be the patch I wrote (available at http://andy.rz.uni-karlsruhe.de/~andy/source/Patches/php-4.3.3/, against PHP 4.3.3 but should apply to other versions, too) which enforces the uid of the process execution the PHP-script and the uid of the directory where a new file should be created to be the same.