Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:54642
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <4E4AE153.20704@thelounge.net>
References: <4E4AE153.20704@thelounge.net>
Date: Wed, 17 Aug 2011 13:14:02 +0200
Message-ID: <CAEZPtU5G_hdqA9pgD3Dw1Wk5dm7LbuoaN64JnE7b5PSBVga=-A@mail.gmail.com>
To: Reindl Harald <h.reindl@thelounge.net>
Cc: Mailing-List php <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] https://bugs.php.net/bug.php?id=52312
From: pierre.php@gmail.com (Pierre Joye)

On Tue, Aug 16, 2011 at 11:29 PM, Reindl Harald <h.reindl@thelounge.net> wrote:
> Hi
>
> https://bugs.php.net/bug.php?id=52312
>
> does the security-problem in combination with open_basedir only
> occur if there are symlinks created?
>
> * i guess in most secure setups "symlink" is disabled

For what I can see, almost no setup disables the symlink functions in
php, even less in the shell.

> * give us a option to bypass the check in such environments

Well, there are other better ways to control access than relying on
open_basedir. Permissions are on, that's why I would not add special
cases here.

Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org