|
|
Posted by J.O. Aho on 09/10/06 15:14
eugene2008 wrote:
> ####################################################
> i tries to jail them by this
> VirtualDocumentRoot "C:/aweb/freehosting/users/__%1/"
> php_admin_value open_basedir "C:/aweb/freehosting/users/__"
>
> but it does not work
Setting open_basedir will affect fopen/gzopen, where a check against the
string is made you given to see if these two functions are allowed to open a
file or not, PHP still have the right to access files outside that/those
directories.
Setting VirtualDocumentRoot/DocumentRoot in a VirtualHost tag will only tell
for Apache where the documents that it's allowed to server are located and do
not affect PHP at all.
Enabling safe_mode/safe_mode_gid can be good if your filesystem supports owner
of files and that files have owners set, this way a file needs to be owned or
belong to the same group as the owner of the executed php script.
To jail PHP/Apache, you need to run Apache in a chrooted environment, this of
course requires an OS which support this, as most unix like OS. Here is an
example on how to do this: http://www.linux.com/article.pl?sid=04/05/24/1450203
I do recommend you upgrade your server OS, sure the one you have "works", but
it's crippled.
//Aho
Navigation:
[Reply to this message]
|