php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #44520 PHP does not have an option of the folders' access prohibition in "php.ini"
Submitted: 2008-03-24 20:00 UTC Modified: 2008-03-24 22:50 UTC
From: nspu at list dot ru Assigned:
Status: Not a bug Package: Feature/Change Request
PHP Version: 5.3CVS-2008-03-24 (CVS) OS: Microsoft Windows 2000 SP4
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: nspu at list dot ru
New email:
PHP Version: OS:

 

 [2008-03-24 20:00 UTC] nspu at list dot ru
Description:
------------
PHP has no prohibition of the folders' access for the scripts in Microsoft Windows 2000, so, the script can get access to any file or folder on any logical disk.
It would be better, if the file "php.ini" had the option to prohibit any access (read/write/delete/rename, etc.) for the PHP scripts for the pointed out folders.
For example:

; the scripts will never get access to files and sub-folders of the
; following folders:
prohibited_folders = "C:\Program Files","C:\WINNT","D:\"

Or something like this...

Expected result:
----------------
Using the option "prohibited_folders" (or something like this), it is expected not to give the access to the pointed out folders and to their all sub-folders for the PHP scripts in the Microsoft Windows platforms.
For example, pointing "C:\WINNT" is expected to prohibit the access to the following folders: "C:\WINNT", "C:\WINNT\system", "C:\WINNT\system32", "C:\WINNT\system32\drivers", etc...

Actual result:
--------------
Now, PHP is still having some "holes" in its safety system. One of them is the free access to any file or folder in the Microsoft Windows platforms.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-24 22:50 UTC] johannes@php.net
Access should be controlled by the operating system, not PHP. Anyways: There's open_basedir which was made for this. See docs.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Jul 03 16:01:36 2025 UTC