Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:20301
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
To: derick@php.net (Derick Rethans)
Cc: internals@lists.php.net
Date: Thu, 24 Nov 2005 17:43:56 +0100
Message-ID: <o4qbo1hsi1qnsj09smbak282ir661pi81l@4ax.com>
References: <Pine.LNX.4.62.0511221852340.31280@localhost>
In-Reply-To: <Pine.LNX.4.62.0511221852340.31280@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: Re: PDM Meeting Notes
From: penguin@php.net (Peter Brodersen)

On Tue, 22 Nov 2005 18:57:19 +0100 (CET), in php.internals
derick@php.net (Derick Rethans) wrote:

>On 11 and 12 November a bunch of us had a developers meeting in Paris,=20
>discussing the things we want to do for PHP 6. Partly because of the=20
>Unicode support, but we also discussed the items on "Rasmus' wishlist"=20
>and a lot of other items. I made a report of the discussions we had and=20
>placed the notes here:
>
>http://php.net/~derick/meeting-notes.html

Very interesting - thanks for the details. It all sounds very
promising.

Regarding safe_mode I agree that I'll never be any kind of magic
wundertool. But as the docs also specify, many shared hosts currently
"rely" on it (meaning they have setups where the users don't have
shell opportunities or other ways of accessing each other's files).

I'm not looking for any near-safe_mode-substitution. I'm more
concerned about the deployment of PHP6 at shared hosts.

Since PHP6 have a bunch of different changes and requires a lot of
information I think there should be put an effort of creating a "best
practices" document for these kind of setups. Something like enabling
open_basedir and disabling exec-functions (popen, exec, shell_exec,
passthru...). Maybe a new setting to disable all of these typies of
functions together - I don't think it is a pretty solution to e.g.
blacklist about six specific functions and hoping that this list is
static.

=46urthermore, and just a though: would it be possible to have an option
when compiling an apache module of setting the open_basedir value to
the same as the virtual host's DOCUMENT_ROOT? I think deployment could
be much easier this way.


(oh yeah, and I really hope glob() results would be passed through
open_basedir checks... furthermore I want a pony!)

--=20
- Peter Brodersen