|
Posted by Miguel Cruz on 11/24/14 11:54
Sensei <senseiwa@mac.com> wrote:
> Since PHP scripts run with the same username as apache, something like
> this is possible:
>
> <?
> system('rm -rf /home/userThatIhate/www/*');
> ?>
>
>
> Is anyone aware of a possible solution about this problem?
Disable system() and similar functions. You will not have security in a
multi-untrusted-user environment when running PHP as an Apache module
unless you do this.
miguel
--
Photos from 40 countries on 5 continents: http://travel.u.nu
Latest photos: Malaysia; Thailand; Singapore; Spain; Morocco
Airports of the world: http://airport.u.nu
Navigation:
[Reply to this message]
|