From: nspu at list dot ru Operating system: Microsoft Windows 2000 SP4 PHP version: 5.3CVS-2008-03-24 (CVS) PHP Bug Type: Feature/Change Request Bug description: PHP does not have an option of the folders' access prohibition in "php.ini"
Description: ------------ PHP has no prohibition of the folders' access for the scripts in Microsoft Windows 2000, so, the script can get access to any file or folder on any logical disk. It would be better, if the file "php.ini" had the option to prohibit any access (read/write/delete/rename, etc.) for the PHP scripts for the pointed out folders. For example: ; the scripts will never get access to files and sub-folders of the ; following folders: prohibited_folders = "C:\Program Files","C:\WINNT","D:\" Or something like this... Expected result: ---------------- Using the option "prohibited_folders" (or something like this), it is expected not to give the access to the pointed out folders and to their all sub-folders for the PHP scripts in the Microsoft Windows platforms. For example, pointing "C:\WINNT" is expected to prohibit the access to the following folders: "C:\WINNT", "C:\WINNT\system", "C:\WINNT\system32", "C:\WINNT\system32\drivers", etc... Actual result: -------------- Now, PHP is still having some "holes" in its safety system. One of them is the free access to any file or folder in the Microsoft Windows platforms. -- Edit bug report at http://bugs.php.net/?id=44520&edit=1 -- Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=44520&r=trysnapshot52 Try a CVS snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=44520&r=trysnapshot53 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=44520&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=44520&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=44520&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=44520&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=44520&r=needscript Try newer version: http://bugs.php.net/fix.php?id=44520&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=44520&r=support Expected behavior: http://bugs.php.net/fix.php?id=44520&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=44520&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=44520&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=44520&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=44520&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=44520&r=dst IIS Stability: http://bugs.php.net/fix.php?id=44520&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=44520&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=44520&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=44520&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=44520&r=mysqlcfg
