Making PHP secure ?

anti posted this at 12:46 — 15th May 2000.

They have: 453 posts

Joined: Jan 1999

Hi,

is there any way to make PHP secure ?

If I have a server with x virtual hosts
and apache runs as nobody, all PHPs have "nobody"-rights.

So every client can access every other clients files
Including config-files which might include DB passwords

I twisted my brain the last two ours, but can't find a solution.

Well, there is one, but running one apache per domain is not exactly what I want

any help ??????

ciao
Anti

anti posted this at 14:46 — 15th May 2000.

They have: 453 posts

Joined: Jan 1999

Just in case you didn't understand the question.

Put this on you webserver and retrieve it via http (with php enabled).

code:

<html>
	<body>
		<?php
			function myPerms( $file ){
				$perms = fileperms( $file );
				$owner = fileowner( $file );
				$uid = getmyuid( );
				$myP[ "r" ] = 0;
				$myP[ "w" ] = 0;
				$myP[ "x" ] = 0;
				if( $uid == $owner ){
					$myP[ "r" ] = ( $perms & 00400 ) ? 1 : 0;
					$myP[ "w" ] = ( $perms & 00200 ) ? 1 : 0;
					$myP[ "x" ] = ( $perms & 00100 ) ? 1 : 0;					
				}else{
					$myP[ "r" ] = ( $perms & 00004 ) ? 1 : 0;
					$myP[ "w" ] = ( $perms & 00002 ) ? 1 : 0;
					$myP[ "x" ] = ( $perms & 00001 ) ? 1 : 0;									
				}
				$myP[ "txt" ] =  ( $myP[ "r" ] ? "r" : "-" ).( $myP[ "w" ] ? "w" : "-" ).( $myP[ "x" ] ? "x" : "-" );
				return( $myP );				
			}
			function ls( $dir = "/", $lvl = 0 ){
				$hdir = opendir( $dir );
				while( $file = readdir( $hdir ) ){
					$myP = myPerms( $dir."/".$file );
					if( $myP[ "r" ]==1 AND $myP[ "x" ]==1 ){
					if( !strcmp( $file, "." )==0 ){
					if( !strcmp( $file, ".." )==0 ){					
						for( $l=0; $l<$lvl; $l++ ){
							print "-->";
						}
						print "(".$myP[ "txt" ].")".$file."<br>";
						if( is_dir( $dir."/".$file ) ){
							ls( $dir."/".$file, $lvl+1 );
						}
					} } }
				}
				closedir( $hdir );
			}
			ls(  );
		?>
	</body>
</html>
[/code]

anti posted this at 17:45 — 16th May 2000.

They have: 453 posts

Joined: Jan 1999

Yes,

but by this I would loose the persistency.
Right ?

And most of the hosts don't have cgiwrap anyway

I think there should be an option in PHP to honor the suid-bit on php files.