PHP harm on WebDAV

[Sensei]

Hi!

I was wondering about the feasibility of having PHP safer than I can
imagine right now.

This is the situation. Apache with webdav enabled for all users in
write mode. Let's say users have /home/username/www as their web sites.
In order to make it work, every www must have write permission set to
apache. This way people can upload their personal web sites via webdav.

Since PHP scripts run with the same username as apache, something like
this is possible:

<?
system('rm -rf /home/userThatIhate/www/*');
?>
Is anyone aware of a possible solution about this problem?

Thanks!

--
Sensei <se******@mac.com>

The optimist thinks this is the best of all possible worlds.
The pessimist fears it is true. [J. Robert Oppenheimer]

[Virginner]

"Sensei" <se******@mac.comwrote in message
news:44***********************@reader4.news.tin.it ...
| Hi!
|
| I was wondering about the feasibility of having PHP safer than I can
| imagine right now.
|
| This is the situation. Apache with webdav enabled for all users in
| write mode. Let's say users have /home/username/www as their web sites.
| In order to make it work, every www must have write permission set to
| apache. This way people can upload their personal web sites via webdav.
|
| Since PHP scripts run with the same username as apache, something like
| this is possible:
|
| <?
| system('rm -rf /home/userThatIhate/www/*');
| ?>
|
|
| Is anyone aware of a possible solution about this problem?

Make sure safe_mode is on... ?

[Miguel Cruz]

Sensei <se******@mac.comwrote:

Since PHP scripts run with the same username as apache, something like
this is possible:

<?
system('rm -rf /home/userThatIhate/www/*');
?>
Is anyone aware of a possible solution about this problem?

Disable system() and similar functions. You will not have security in a
multi-untrusted-user environment when running PHP as an Apache module
unless you do this.

miguel
--
Photos from 40 countries on 5 continents: http://travel.u.nu
Latest photos: Malaysia; Thailand; Singapore; Spain; Morocco
Airports of the world: http://airport.u.nu

[Sensei]

On 2006-08-02 19:28:25 +0200, "Virginner" <th*******@virginLOSEIT.netsaid:

| <?
| system('rm -rf /home/userThatIhate/www/*');
| ?>
|
|
| Is anyone aware of a possible solution about this problem?

Make sure safe_mode is on... ?

Yes, I've tried that. Seems to work but I don't know if this affects
some user script. Maybe it's unsafe since some users may have files
belonging to other UID/GID.

--
Sensei <se******@mac.com>

The optimist thinks this is the best of all possible worlds.
The pessimist fears it is true. [J. Robert Oppenheimer]

[Sensei]

On 2006-08-02 19:58:34 +0200, Miguel Cruz <sp**@admin.u.nusaid:

><?
system('rm -rf /home/userThatIhate/www/*');
?>
Is anyone aware of a possible solution about this problem?

Disable system() and similar functions. You will not have security in a
multi-untrusted-user environment when running PHP as an Apache module
unless you do this.

Do you have any link that shows how to disable particular functions?
How's the granularity that I can apply --- and that you suggest?

--
Sensei <se******@mac.com>

The optimist thinks this is the best of all possible worlds.
The pessimist fears it is true. [J. Robert Oppenheimer]

[Miguel Cruz]

Sensei <se******@mac.comwrote:

Miguel Cruz <sp**@admin.u.nusaid:

>Disable system() and similar functions. You will not have security
in a multi-untrusted-user environment when running PHP as an Apache
module unless you do this.

Do you have any link that shows how to disable particular functions?
How's the granularity that I can apply --- and that you suggest?

http://my2.php.net/manual/en/feature...able-functions

You just put it in php.ini, and you can disable any functions you please.

For instance:

disable_functions = exec,passthru,proc_open,shell_exec,system

I wouldn't stake my career on it but I think that'll cover the ones that
allow PHP code to invoke arbitrary external programs.

miguel
--
Photos from 40 countries on 5 continents: http://travel.u.nu
Latest photos: Malaysia; Thailand; Singapore; Spain; Morocco
Airports of the world: http://airport.u.nu

[Sensei]

On 2006-08-03 19:48:45 +0200, Miguel Cruz <sp**@admin.u.nusaid:

>Do you have any link that shows how to disable particular functions?
How's the granularity that I can apply --- and that you suggest?

http://my2.php.net/manual/en/feature...able-functions

You just put it in php.ini, and you can disable any functions you please.

For instance:

disable_functions = exec,passthru,proc_open,shell_exec,system

I wouldn't stake my career on it but I think that'll cover the ones
that allow PHP code to invoke arbitrary external programs.

Thank you very much, that helped a lot!

--
Sensei <se******@mac.com>

The optimist thinks this is the best of all possible worlds.
The pessimist fears it is true. [J. Robert Oppenheimer]