Re: [PHP-DEV] uhm.. *swallows*.. security thingy?

2001-12-12 Thread Teodor Cimpoesu
Hi Zeev! On Tue, 11 Dec 2001, Zeev Suraski wrote: At 15:23 11/12/2001, Mathieu Kooiman wrote: On Tue, 2001-12-11 at 14:04, Zeev Suraski wrote: At 12:36 11/12/2001, Mathieu Kooiman wrote: On Tue, 2001-12-11 at 11:29, Zeev Suraski wrote: Would the cwd of the PHP CGI be inside the user's

Re: [PHP-DEV] uhm.. *swallows*.. security thingy?

2001-12-12 Thread Zeev Suraski
At 11:20 12/12/2001, Teodor Cimpoesu wrote: [rant++] I don't think it's a problem for a user to make a copy of the php binary somewhere in any of those dirs, where the cwd at runtime is a writeable dir... Well, if he can run arbitrary files from his own directories, you're screwed anyway, much

Re: [PHP-DEV] uhm.. *swallows*.. security thingy?

2001-12-11 Thread Zeev Suraski
Would the cwd of the PHP CGI be inside the user's dir? Did you test it in a real CGI environment? Zeev At 12:23 11/12/2001, Mathieu Kooiman wrote: There's a problem with PHP cgi binaries: CaPS_ (was a CVS, so..) CaPS_ which reminds me CaPS_ remember my ranting about php.ini derick? CaPS_ (it

Re: [PHP-DEV] uhm.. *swallows*.. security thingy?

2001-12-11 Thread Zeev Suraski
At 12:36 11/12/2001, Mathieu Kooiman wrote: On Tue, 2001-12-11 at 11:29, Zeev Suraski wrote: Would the cwd of the PHP CGI be inside the user's dir? Did you test it in a real CGI environment? Zeev Err, PHP CGI would be in /usr/local/bin/php.. Yeah, but that's not what I asked - I asked

Re: [PHP-DEV] uhm.. *swallows*.. security thingy?

2001-12-11 Thread Mathieu Kooiman
On Tue, 2001-12-11 at 14:04, Zeev Suraski wrote: At 12:36 11/12/2001, Mathieu Kooiman wrote: On Tue, 2001-12-11 at 11:29, Zeev Suraski wrote: Would the cwd of the PHP CGI be inside the user's dir? Did you test it in a real CGI environment? Zeev Err, PHP CGI would be in

Re: [PHP-DEV] uhm.. *swallows*.. security thingy?

2001-12-11 Thread Zeev Suraski
At 15:23 11/12/2001, Mathieu Kooiman wrote: On Tue, 2001-12-11 at 14:04, Zeev Suraski wrote: At 12:36 11/12/2001, Mathieu Kooiman wrote: On Tue, 2001-12-11 at 11:29, Zeev Suraski wrote: Would the cwd of the PHP CGI be inside the user's dir? Did you test it in a real CGI