Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82011
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.54 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAEZPtU5hEzyNZkNKcmPY4pfrL1Nc-Dzsu3-ogXtuhimCOgsj5Q@mail.gmail.com>
References: <CAGa2bXZMxxXBOQ=NdbNtzgrjjvdomV8zOr+Z4zASZU4+JHmqyw@mail.gmail.com>
 <CAGa2bXbf=hzbZ9eH6JVnMM0+6OeTQvAoqBe44g8qxFAAr9u9Kw@mail.gmail.com>
 <CAG1choq8S_EkdS22SFO+443u_LYVB-Z-b2ra6RK8sDhrJKc-VQ@mail.gmail.com>
 <CAGa2bXbJyK=2GCmGDw7PAh0ib=EL9GO7FFGf0X6VyAWqfR8EAA@mail.gmail.com>
 <CADajX4CHHdSpUfLfjhwrtdzmJfg9di4FpfeVEzBG4P7K7B+e0w@mail.gmail.com>
 <CAPwsocGh_-SYiWceEg=5go8G1bUs+CWUBb9uv_2Oh7AZhBxd8A@mail.gmail.com>
 <CAGa2bXY36wVN50sQ=MTYi+X6664+NYqMhsYFVZ9jeFZ1DXBg9Q@mail.gmail.com>
 <CAEZPtU5=vJG6=cguZfcT6RBriu8GT9vfW=Lqva8-XfEnXzZ23Q@mail.gmail.com>
 <CAGa2bXarZ4A9+HPXniAvBxEtE9KEJTYHHW8aYHCkBsNN5dRNUw@mail.gmail.com>
 <CAEZPtU4ThQHcH1hsgYaKwd2yOKAGP7obmcDH15qbDVr6CdgzSQ@mail.gmail.com>
 <CAGa2bXbWZJ--nkPaskRfCB91wqXSfY7LCwTefVa-ERxaY2r8Nw@mail.gmail.com>
 <CAEZPtU6mhc4asyeiab8RmFwBcUT873eXB1EPoePswQ0Xw0392g@mail.gmail.com>
 <CAGa2bXbcrS339yoyg4q3GakaGHSuc5Ga_Rd4A3E7=50xKRhfrw@mail.gmail.com>
 <CAEZPtU7Ywfha2BLXR+rrOc5ZdV4rEuxyAFvNddngR8jyEPH=Aw@mail.gmail.com>
 <CAGa2bXbygxH8=Con3_OckFW4V+WmD97axAZ+VOo2rnrY8gz12g@mail.gmail.com>
 <CAEZPtU7vuygaLPGdE-T8Ep_-GTg_Vzsggb1BRgjSHhU09n7z+w@mail.gmail.com>
 <CAGa2bXbfrAw6P5=cFA3bWUZ3rxm9aquCODB5+e=ZR6NUzY+y_A@mail.gmail.com> <CAEZPtU5hEzyNZkNKcmPY4pfrL1Nc-Dzsu3-ogXtuhimCOgsj5Q@mail.gmail.com>
Date: Fri, 6 Feb 2015 13:35:11 +0900
Message-ID: <CAGa2bXaGrR9mPGDVEzEMX3uXJuRq5Fgqn4tDqttzSKN8RSpnYg@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Adam Harvey <aharvey@php.net>, PHP internals <internals@lists.php.net>, Leigh <leight@gmail.com>, 
	reeze <reeze@php.net>
Content-Type: multipart/alternative; boundary=001a1133dee6987028050e63f4d5
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] script() and script_once()
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1133dee6987028050e63f4d5
Content-Type: text/plain; charset=UTF-8

Hi Pierre,

On Fri, Feb 6, 2015 at 1:16 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> > With SElinux, we can restrict access. However, PHP should be able to
> > read/write
> > uploaded files. PHP just read and execute them with include.
>
> Again, I am talking about executing files. You can exclude a file,
> path, folder for being invoked with a handler or similar things on a
> web server. It has nothing to do with the PHP ability to access this
> file as normal data. That won't prevent a file_get_contents+eval but
> you get the idea.
>

OK.


>
> > Is windows possible to prevent PHP to load script and execute? While
> > allowing write/read access?
>
> Yes and no. It is a web server role. Linux allows access restrictions
> too, windows only provides a much more fine grained ACL. But again, it
> is not what I am referring to.
>
>
> > I have similar idea for PHP to have data only dirs.
>
> We have that already, not for php, but for web servers. This is their
> job to deal with that.


Yes, indeed.
engine=off
per dirs. This is what I suggest people. It cannot prevent other dir's
PHP scripts to load & execute. Public upload dir must have this setting.

My idea is controlling it from PHP, not as web server management.
It's better than per dir "engine=off".
It's not too important for me now, so it's not my priority.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1133dee6987028050e63f4d5--