Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: Sandbox Date: Fri, 05 Jul 2013 18:24:03 +0200 Lines: 36 Message-ID: References: <7a68d12f-b9f2-4367-b373-f6be14b9994b@googlegroups.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net LTEcXb7evDs6qkwF99f8NgNRuLp6OCgK2oNZ52gGfAwlM3cWj+ Cancel-Lock: sha1:c+VNyRDScHMvuwuiRuL1myPWSEU= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130628 Thunderbird/17.0.7 In-Reply-To: Xref: csiph.com comp.lang.php:10031 On 05/07/13 14:25, Jerry Stuckle wrote: > On 7/5/2013 7:38 AM, sanjayrathod273@gmail.com wrote: >> HEy guys Help me >> >> I want to use sandbox for my site's security. below is the link of >> method which i want to use http://php.net/manual/en/runkit.sandbox.php. >> >> but when i am run the code of that page it says sandbox class not >> defined. >> so anyone can guide me through this step by step. >> Please help me my site has down due to hacking. i want to use for this >> site >> http://web.guru99.com/demo-editor-php/ >> > > Look at the documentation - you need the runkit PECL class. But that > has not been updated for seven years and will not compile with PHP > versions > 5.2. It looks like you're out of luck. > > But then while I think what you're trying to do is admirable, I don't > think you'll be able to stop hacking without pretty much crippling your > users. Anyone developing (or learning) PHP should have their own > development environment, anyway. > There are other options to "sandbox" the users, suExec will give you some capabilities and then on you can also run the apache in a chroot environment. This way you can limit the access through the webserver to the rest of the server environment and limit the sites from accessing each others data. I usually apply the suhosin to the php and set a bit limitation that way too. Doing all that you need of course a Linux/Unix server. -- //Aho