Re: RE: exec( ) function on winNT

Hi Thanx I am quite sure that user data won't be a problem What I want to know is if NT will allow me to run my program which resides in my own user directory ----- Original Message ----- From: Mark Nold <markn@alverstone.com.au> To: 'Anurag Bhalla' <anuragbhalla@id.eth.net>; <php-general@lists.php.net>; <php-windows@lists.php.net> Sent: Wednesday, July 12, 2000 4:49 PM Subject: [PHP] RE: exec( ) function on winNT > Yes or No. > > Everything that is run by PHP under NT should be run as the owner or the > webserver. But i would test it yourself, try deleting things with > exec("delete c:\winnt") and see what happens :) > > You should also make sure that any user data that is passed to the command > line isnt a problem. escapeshell (or whatever) _may_ not be right for NT. > EG: you may have > exec("mkdir $foo"); > > (Maybe you should just set a few files and direectories secured to other > users and groups, then try deleting them) > > Be aware that it may be possible for a user to set $foo to " > anyfile/r/ndelete c:\winnt" or maybe "afile | delete c:\winnt" i dont know > what would happen.. but you should try em out, (This is why you should > completely avoid exec and the like in any tool with user input, they are > one of the more causes of security breaches) > > mn > > > > Mark Nold > markn@alverstone.com.au > Systems Consultant > > Change is inevitable, except from vending machines. > > > > > On Wednesday, 12 July 2000 11:51, Anurag Bhalla > [SMTP:anuragbhalla@id.eth.net] wrote: > > Hie > > > > I want to know if the exec( ) function which runs a command line > operation > > pose any threat to NT security ie is the execution of this function > banned by win NT > > environment. > > > > U c a n a ns w e r j u s t Y e s or N o, b u t p l s a n > s w e r > > > > Thanx > > Anurag > > > > > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >