FUDforum: comp.lang.php » execute php in template

Home » Imported messages » comp.lang.php » execute php in template

Show: Today's Messages :: Polls :: Message Navigator

Re: execute php in template [message #175778 is a reply to message #175777]

Mon, 24 October 2011 01:37

Hans Olo
Messages: 7
Registered: October 2011

Karma:

Junior Member

On 10/23/2011 6:38 PM, Jerry Stuckle cried from the depths of the abyss:
>
>>> what if someone snuck into
>>> your code something like:
>>> system('rm -r /');
>>
>> How would someone be able to do that? From the "outside" there's no
>> access to do this, right?
>
> Are you sure? Sony thought so...
>

Keep in mind that the rm request can only delete files that have the
same permissions as the httpd user. This is why apache recommends
creating a bs account (httpd, acache, joeblow, etc.) to use to run the
httpd server. Almost all stock httpd configs use a bogus user (either
configged by a package, or a requirement if compililng from source), and
this wouldn't delete too much except www related files & perhaps some
config files.

/ will only get deleted if the httpd is being run as root

Report message to a moderator

[Message index]

		execute php in template By: cerr on Sun, 23 October 2011 19:47
		Re: execute php in template By: Jerry Stuckle on Sun, 23 October 2011 20:29
		Re: execute php in template By: The Natural Philosoph on Sun, 23 October 2011 21:03
		Re: execute php in template By: cerr on Sun, 23 October 2011 22:43
		Re: execute php in template By: Gregor Kofler on Sun, 23 October 2011 23:20
		Re: execute php in template By: Jerry Stuckle on Sun, 23 October 2011 23:38
		Re: execute php in template By: Hans Olo on Mon, 24 October 2011 01:37
		Re: execute php in template By: Jerry Stuckle on Mon, 24 October 2011 02:30
		Re: execute php in template By: Hans Olo on Mon, 24 October 2011 12:39
		Re: execute php in template By: Jerry Stuckle on Mon, 24 October 2011 13:16
		Re: execute php in template By: Goran on Mon, 24 October 2011 07:02

Previous Topic:	Using PHP Tags in eval()
Next Topic:	pear include path

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Tue Nov 26 12:24:52 GMT 2024

Total time taken to generate the page: 0.04071 seconds