note 51293 added to security.apache

To Pollox and anyone else considerig using "open_basedir" without safe mode. Open_basedir does NOT protect against this: <? exec("/usr/bin/cat /etc/passwd",$output); var_dump($output) ; ?> outputting the password file (which is world readable) or <?php exec("/bin/ls -lhaR /") ; ?> recursively outputting your filesystem. ANY system comand can be run through the exec and system function as the apache user. Safe mode and it's family of configuration options are the ONLY way to protect against this. ---- Manual Page -- http://www.php.net/manual/en/security.apache.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+51293 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+51293&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+51293&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+51293&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+51293&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+51293&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+51293&report=yes Search -- http://master.php.net/manage/user-notes.php