safe_mode won't take
| From: | Glenn Little | Date: | Wed, 29 Mar 2000 04:36:06 +0000 |
| Subject: | safe_mode won't take | ||
| Groups: | php.version4 | ||
| Request: | Send a blank email to php-version4+get-12780@lists.php.net to get a copy of this message | ||
I've installed php4/apache1.3.12 under solaris. Thought I turned on
safe_mode and exec_dir during the config (see flags below), but when
I run php, it still allows me to do non-safe-mode things like run any
system command with system().
Also, php_info() shows php_safe_mode as "Off" for both local and master
values (I'm doing this without a php.ini file), and php_exec_dir as
"no value" for both local and master values.
If I do put a php.ini file out there and explicitly set safe_mode to
"On", it does at least stop me from running the system binaries. However,
I'd sure like to believe in and trust the compiled-in configs. Anyone
know what might be wrong? My understanding is that --enable-safe-mode=yes
during the configure step should mean that the default behavior barring
any php.ini files (or apache configs) would be that safe_mode was on.
By the way, php_info does correctly show the "configure command". It's
just the php core configuration table (not to mention the actual behavior
of php :-) that isn't what I expect.
Here's my config flag set:
--with-apache=../apache_1.3.12
--prefix=/web/php-4.0b4pl1
--with-config-file-path=/web/php
--with-gd=no
--enable-sysvshm=yes
--enable-sysvsem=yes
--enable-safe-mode=yes
--with-exec-dir=/web/php/safe-bin
--enable-track-vars=yes
--enable-trans-sid=yes
--enable-force-cgi-redirect=yes
--enable-memory-limit=yes
--with-xml
--enable-short-tags=no
Thanks.
-glenn
little@cs.ucsd.edu