note 36479 deleted from security.filesystem by vincent
| From: | vincent@php.net | Date: | Sat, 11 Oct 2003 07:36:41 +0000 |
| Subject: | note 36479 deleted from security.filesystem by vincent | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-58223@lists.php.net to get a copy of this message | ||
Note Submitter: developer (at) as (dot) ro
----
Many free webhosting (with php enabled) Apache<2 servers allocates for each user a dir in
wwwroot/.
This is a huge security hole since any user can run a script (on his dir) that read the other ones
scripts with a simple highlight_file("../NotMine/file.php") for example, since Apache
user can access all of them.
Yes i know there are some directives such open_dir (but it's default on 'any' or
safe_mode (which is not a solution).
Apache 2 has for each vhost an user and this is a solution but how it remains w/ Apache 1.3?
Is there a solution or not (with the schema i mentioned above)
What do u think guys?