Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:13594 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 1331 invoked by uid 1010); 29 Oct 2004 15:24:05 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 920 invoked from network); 29 Oct 2004 15:24:01 -0000 Received: from unknown (HELO miranda.org) (209.58.150.153) by pb1.pair.com with SMTP; 29 Oct 2004 15:24:01 -0000 Received: (qmail 16645 invoked by uid 546); 29 Oct 2004 15:24:00 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 29 Oct 2004 15:24:00 -0000 Date: Fri, 29 Oct 2004 11:24:00 -0400 (EDT) X-X-Sender: adam@miranda.org To: Klaus Reimer cc: internals@lists.php.net In-Reply-To: <4182029F.2040700@ailis.de> Message-ID: References: <41811956.4050405@caedmon.net> <20041029105149.3b150c7d.tony2001@phpclub.net> <24e5f3b704102901044714577f@mail.gmail.com> <4182029F.2040700@ailis.de> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Subject: Re: [PHP-DEV] curl_init() is bypassing safe_mode & open_basedir restrictions From: adam@trachtenberg.com (Adam Maccabee Trachtenberg) On Fri, 29 Oct 2004, Klaus Reimer wrote: > Sterling Hughes wrote: > > no.... curl does not need to respect php's safemode, adding such > > checks at this level is wrong. people who compile curl, can do so > > without local file access, and this will solve their problem. > > What about people who use precompiled packages like the Debian packages? > They don't have a "special" Curl for PHP. The curl debian package will > never "disable" file-support just because it breaks a feature of PHP. So > Debian users can't use safemode then if they need the curl extension and > if they don't want (or don't know how) to compile the stuff. Safe mode is for people who are running shared servers and want to wall off areas. If you're doing this, you should be willing and able to configure programs if necessary. I don't mind making ISP sys admins configure cURL with a special flag, nor do I think it's too onerous a burden. -adam -- adam@trachtenberg.com author of o'reilly's "upgrading to php 5" and "php cookbook" avoid the holiday rush, buy your copies today!