[EMAIL PROTECTED] wrote: > Hi again, > > I believe it should disallow openning a directory in safe mode if the UID > of the directory does not match the UID of the PHP script. > > That is exactly the behavior of fopen() in safe mode.
> Without that behavior, users are permitted to write a PHP script that lets > them crawl around the webserver seeing things they have no rights to see. Now I see what you want :) > It happens on our system that there will never be any files owned by > user A under a directory owned by user B. But even if there were, I think > safe mode should disallow this type of filesystem reading. Under UNIX like systems, /tmp is world writable and everyone on the system can open dir/wirte/read files, but it's possible to secure files/directory under /tmp. I think you can apply the same. GID support also helps to allow opening files certain group. Is it not enough for your security needs? > > Do you think the fact that this file reading is permitted is a bug that > should be reported? > I think the feature that check dir UID/GID will be useful for some prople. How about submit a feature request (It's one of bug report types) BTW, you have opotion that disallow opendir at all, with disable_functions directive in php.ini -- Yasuo Ohgaki _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] To contact the list administrators, e-mail: [EMAIL PROTECTED]
