Full Disclosure mailing list archives
Re: How secure is PHP ?
From: Matt <smp.repicky () gmail com>
Date: Fri, 5 Nov 2004 10:01:54 -0500
I think one thing worth mentioning is that in *most* PHP installations, the PHP code will be executed as the web server user. This means that the several hundred IT students will be able to read each other's code and write to each other's datastores. Most students will have to chmod a+w any files or directories that will be modified by their PHP code. There are several ways around this, but it does take more configuration and security smarts to implement. This "vulnerability" (if you can call it that) exists in just about every multi-user web system out there, so it's probably worth your time to investigate different security mechanisms.
There is actually a very easy way around this. If you are running an LDAP or AD environment, you can use the LDAP to authenticate the users, then once the user is authenticated, take the username and store that into a variable which you can then use to chown and chgrp the resulting files for that user after they are written. Doesn't take much to execute a connect() to an LDAP server, mb like 10 lines to make it nice and clean? Haven't written one in a while. But I know when I was writing PHP code to connect to Oracle systems a few years ago I was tasked to authenticate with an LDAP server before allowing access to the backend database. -- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: How secure is PHP ?, (continued)
- Re: How secure is PHP ? Stefan Esser (Nov 04)
- Re: How secure is PHP ? Ron DuFresne (Nov 22)
- Re: How secure is PHP ? Gary E. Miller (Nov 04)
- Re: How secure is PHP ? Dan Margolis (Nov 11)
- Re: How secure is PHP ? Adam Jacob Muller (Nov 02)
- Re: How secure is PHP ? Morgan Reed (Nov 02)
- RE: How secure is PHP ? Sandeep Sengupta (Nov 01)
- Re: How secure is PHP ? Meder Kydyraliev (Nov 01)
- Re: How secure is PHP ? J b (Nov 04)
- Re: How secure is PHP ? VeNoMouS (Nov 04)
- Re: How secure is PHP ? Matt (Nov 05)
- Re: How secure is PHP ? Gary E. Miller (Nov 05)
- Re: How secure is PHP ? Matt (Nov 05)