Re: [PHP4BETA] Correction
| From: | Stanislav Malyshev | Date: | Mon, 13 Dec 1999 10:41:35 +0000 |
| Subject: | Re: [PHP4BETA] Correction | ||
| References: | 1 | Groups: | php.version4 |
| Request: | Send a blank email to php-version4+get-7844@lists.php.net to get a copy of this message | ||
JJ>> ''so maybe it's wish to use it'' should be ''so maybe
JJ>> it's wise to use
JJ>> it'' and by that I mean: the suid-flag is maybe a good indicatior to use
JJ>> since php scripts should never have the executable flag (''x'') set.
Why not? If you want to run them via #!, they can.
The model that can be used in this case might be like perl's suidperl -
i.e., restricted SUID launcher. Still, I'm not sure PHP is secure enough
for such a things - did anyone make security audit for hidden overflows,
etc. (like in cookie/variables import routines, filename handling, etc.,
etc.).
--
Stanislav Malyshev stas@zend.com
+972-50-624945