Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:26047 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 47500 invoked by uid 1010); 13 Oct 2006 01:45:22 -0000 Delivered-To: ezmlm-scan-internals@lists.php.net Delivered-To: ezmlm-internals@lists.php.net Received: (qmail 47485 invoked from network); 13 Oct 2006 01:45:22 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 13 Oct 2006 01:45:22 -0000 Received: from [127.0.0.1] ([127.0.0.1:23278]) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ECSTREAM id 06/66-02720-2BFEE254 for ; Thu, 12 Oct 2006 21:45:22 -0400 X-Host-Fingerprint: 202.63.61.242 cust3058.vic01.dataco.com.au Received: from [202.63.61.242] ([202.63.61.242:9001] helo=localhost.localdomain) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 53/46-02720-CEEEE254 for ; Thu, 12 Oct 2006 21:42:06 -0400 Message-ID: <53.46.02720.CEEEE254@pb1.pair.com> To: internals@lists.php.net Date: Fri, 13 Oct 2006 11:42:09 +1000 User-Agent: Thunderbird 1.5.0.7 (Windows/20060909) MIME-Version: 1.0 References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Posted-By: 202.63.61.242 Subject: Re: open_basedir enhancement, runtime tightening From: tstarling@wikimedia.org (Tim Starling) Sara Golemon wrote: > The attached patch changes open_basedir from PHP_INI_SYSTEM to PHP_INI_ALL. [...] > The advantage of doing this is that package authors and/or users of shared > hosting who may not have access to making their settings more restrictive > can avoid most simple FS inspection attacks caused by buggy script code by > adding a single ini_set(basedir(__FILE__)); to the top of their script or > setting it with an .htaccess directive. Great feature. I can see this being very useful to packaged PHP applications like ours (MediaWiki). The only complication in implementation I can think of is trying to work out the location of PEAR, for those modules that use it. I suppose we would have to append the default include_path to the runtime open_basedir, to make sure that PEAR is accessible. -- Tim Starling