Re: [PHP4BETA] safe_mode won't take

Glenn, I may be wrong, but I /think/ that safe_mode is /ONLY/ available via the php.ini. --Joey Smith Please forgive the long sig: *** Notice To Bulk Emailers: Attention! Pursuant to US Code, Title 47, Chapter 5, Subchapter II, 227, any & all unsolicited commercial e-mail sent to this address is subject to a download and archival fee in the amount of the $1500 US and copies will be forwarded to domain administrators. Emailing denotes acceptance of said terms! On Tue, 28 Mar 2000, Glenn Little wrote: > I've installed php4/apache1.3.12 under solaris. Thought I turned on > safe_mode and exec_dir during the config (see flags below), but when > I run php, it still allows me to do non-safe-mode things like run any > system command with system(). > > Also, php_info() shows php_safe_mode as "Off" for both local and master > values (I'm doing this without a php.ini file), and php_exec_dir as > "no value" for both local and master values. > > If I do put a php.ini file out there and explicitly set safe_mode to > "On", it does at least stop me from running the system binaries. However, > I'd sure like to believe in and trust the compiled-in configs. Anyone > know what might be wrong? My understanding is that --enable-safe-mode=yes > during the configure step should mean that the default behavior barring > any php.ini files (or apache configs) would be that safe_mode was on. > > By the way, php_info does correctly show the "configure command". It's > just the php core configuration table (not to mention the actual behavior > of php :-) that isn't what I expect. > > Here's my config flag set: > > --with-apache=../apache_1.3.12 > --prefix=/web/php-4.0b4pl1 > --with-config-file-path=/web/php > --with-gd=no > --enable-sysvshm=yes > --enable-sysvsem=yes > --enable-safe-mode=yes > --with-exec-dir=/web/php/safe-bin > --enable-track-vars=yes > --enable-trans-sid=yes > --enable-force-cgi-redirect=yes > --enable-memory-limit=yes > --with-xml > --enable-short-tags=no > > Thanks. > > -glenn > little@cs.ucsd.edu > > > -- > PHP 4.0 Beta Mailing List <http://www.php.net/version4/> > To unsubscribe, e-mail: php4beta-unsubscribe@lists.php.net > For additional commands, e-mail: php4beta-help@lists.php.net > To contact the list administrators, e-mail: php4beta-admin@lists.php.net > >