Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:32010
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: unknown (pb1.pair.com: domain php.net does not designate 195.41.46.235 as permitted sender)
To: rasmus@lerdorf.com (Rasmus Lerdorf)
Cc: internals@lists.php.net
Date: Sun, 02 Sep 2007 14:11:28 +0200
Message-ID: <8q9ld3l6ii25nhdnv2erf2picvu3dp369p@4ax.com>
References: <20070826193146.GQ16782@arvo.suso.org> <46D1ED8A.2060302@zend.com> <20070827024804.GS16782@arvo.suso.org> <46D26834.9040001@lerdorf.com>
In-Reply-To: <46D26834.9040001@lerdorf.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Safe mode being removed in PHP6?
From: penguin@php.net (Peter Brodersen)

On Sun, 26 Aug 2007 22:59:16 -0700, in php.internals
rasmus@lerdorf.com (Rasmus Lerdorf) wrote:

> As PHP grew
>and became more complex and linked in more complex libraries, it became
>completely impossible to even begin to pretend that safemode was still
>effective.=20

1=C2=BD year ago we talked about unbundling the safe_mode_exec_dir and
keeping that alive:
http://news.php.net/php.internals/20417

Is this still relevant? I like the idea much more than users should
maintain their own disabled_functions list to prevent current and new
exec functions.

--=20
- Peter Brodersen