php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #44520 PHP does not have an option of the folders' access prohibition in "php.ini"
Submitted: 2008-03-24 20:00 UTC Modified: 2008-03-24 22:50 UTC
From: nspu at list dot ru Assigned:
Status: Not a bug Package: Feature/Change Request
PHP Version: 5.3CVS-2008-03-24 (CVS) OS: Microsoft Windows 2000 SP4
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: nspu at list dot ru
New email:
PHP Version: OS:

 

 [2008-03-24 20:00 UTC] nspu at list dot ru
Description:
------------
PHP has no prohibition of the folders' access for the scripts in Microsoft Windows 2000, so, the script can get access to any file or folder on any logical disk.
It would be better, if the file "php.ini" had the option to prohibit any access (read/write/delete/rename, etc.) for the PHP scripts for the pointed out folders.
For example:

; the scripts will never get access to files and sub-folders of the
; following folders:
prohibited_folders = "C:\Program Files","C:\WINNT","D:\"

Or something like this...

Expected result:
----------------
Using the option "prohibited_folders" (or something like this), it is expected not to give the access to the pointed out folders and to their all sub-folders for the PHP scripts in the Microsoft Windows platforms.
For example, pointing "C:\WINNT" is expected to prohibit the access to the following folders: "C:\WINNT", "C:\WINNT\system", "C:\WINNT\system32", "C:\WINNT\system32\drivers", etc...

Actual result:
--------------
Now, PHP is still having some "holes" in its safety system. One of them is the free access to any file or folder in the Microsoft Windows platforms.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-24 22:50 UTC] johannes@php.net
Access should be controlled by the operating system, not PHP. Anyways: There's open_basedir which was made for this. See docs.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed May 15 22:01:32 2024 UTC