Re: execute php in template

From	Jerry Stuckle <jstucklex@attglobal.net>
Newsgroups	comp.lang.php
Subject	Re: execute php in template
Date	2011-10-23 22:30 -0400
Organization	A noiseless patient Spider
Message-ID	<j82iku$4bg$1@dont-email.me> (permalink)
References	<a7a128ef-7730-4b2b-be6c-5fda82c287cf@31g2000prp.googlegroups.com> <j81vf4$heo$1@news.albasani.net> <b0d7f670-0c74-4486-b74e-8231778d305c@x16g2000prd.googlegroups.com> <j828h9$h3i$2@dont-email.me> <bm3pq.8341$Oz5.7192@newsfe16.iad>

Show all headers | View raw

On 10/23/2011 9:37 PM, Hans Olo wrote:
> On 10/23/2011 6:38 PM, Jerry Stuckle cried from the depths of the abyss:
>>
>>>> what if someone snuck into
>>>> your code something like:
>>>> system('rm -r /');
>>>
>>> How would someone be able to do that? From the "outside" there's no
>>> access to do this, right?
>>
>> Are you sure? Sony thought so...
>>
>
> Keep in mind that the rm request can only delete files that have the
> same permissions as the httpd user. This is why apache recommends
> creating a bs account (httpd, acache, joeblow, etc.) to use to run the
> httpd server. Almost all stock httpd configs use a bogus user (either
> configged by a package, or a requirement if compililng from source), and
> this wouldn't delete too much except www related files & perhaps some
> config files.
>
> / will only get deleted if the httpd is being run as root

Please read what I said in my first post.  And never count on the 
process being a bogus user with limited rights.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attglobal.net
==================

Thread

execute php in template cerr <ron.eggler@gmail.com> - 2011-10-23 12:47 -0700
  Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-23 16:29 -0400
  Re: execute php in template The Natural Philosopher <tnp@invalid.invalid> - 2011-10-23 22:03 +0100
    Re: execute php in template cerr <ron.eggler@gmail.com> - 2011-10-23 15:43 -0700
      Re: execute php in template Gregor Kofler <usenet@gregorkofler.com> - 2011-10-24 01:20 +0200
      Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-23 19:38 -0400
        Re: execute php in template Hans Olo <doctor@vaderlishious.com> - 2011-10-23 20:37 -0500
          Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-23 22:30 -0400
            Re: execute php in template Hans Olo <doctor@vaderlishious.com> - 2011-10-24 07:39 -0500
              Re: execute php in template Jerry Stuckle <jstucklex@attglobal.net> - 2011-10-24 09:16 -0400
  Re: execute php in template Goran <goran@nospam.com> - 2011-10-24 09:02 +0200

csiph-web