How does safe_mode_exec_dir work?

[Christoph Burschka]

The manual (http://de3.php.net/manual/en/features.safe-mode.php) says
only this about safe_mode_exec_dir:

If PHP is used in safe mode, system() and the other functions
executing system programs refuse to start programs that are not in
this directory. You have to use / as directory separator on all
environments including Windows.

But what effect does this variable actually have - will this directory
automatically be the "local" directory for system calls?

For example, if it is set to /home/php-safe, and this directory contains
the program "helloworld.sh":

Will this work?

system("/home/php-safe/helloworld.sh");

And will this?

system("helloworld.sh");

Also, if the program is not in this directory, but in the parent
directory, will this be blocked as it should?

system("../helloworld.sh");

--
CB

[J.O. Aho]

Christoph Burschka wrote:

The manual (http://de3.php.net/manual/en/features.safe-mode.php) says
only this about safe_mode_exec_dir:

If PHP is used in safe mode, system() and the other functions
executing system programs refuse to start programs that are not in
this directory. You have to use / as directory separator on all
environments including Windows.

But what effect does this variable actually have - will this directory
automatically be the "local" directory for system calls?

For example, if it is set to /home/php-safe, and this directory contains
the program "helloworld.sh":

Will this work?

system("/home/php-safe/helloworld.sh");

And will this?

system("helloworld.sh");

Also, if the program is not in this directory, but in the parent
directory, will this be blocked as it should?

system("../helloworld.sh");

I never used this myself, but I would guess system("/helloworld.sh"); would be
the right way to call the script.

Why not test?

--

//Aho

[Curtis]

On Wed, 31 Jan 2007 03:40:08 -0800, Christoph Burschka
<ch****************@rwth-aachen.dewrote:

The manual (http://de3.php.net/manual/en/features.safe-mode.php) says
only this about safe_mode_exec_dir:

If PHP is used in safe mode, system() and the other functions
executing system programs refuse to start programs that are not in
this directory. You have to use / as directory separator on all
environments including Windows.

But what effect does this variable actually have - will this directory
automatically be the "local" directory for system calls?

For example, if it is set to /home/php-safe, and this directory contains
the program "helloworld.sh":

Will this work?

system("/home/php-safe/helloworld.sh");

And will this?

system("helloworld.sh");

Also, if the program is not in this directory, but in the parent
directory, will this be blocked as it should?

system("../helloworld.sh");

Safe mode is going to be removed, eventually. Why do you need it on?

--
Curtis, http://dyersweb.com

[Christoph Burschka]

Curtis schrieb:

On Wed, 31 Jan 2007 03:40:08 -0800, Christoph Burschka
<ch****************@rwth-aachen.dewrote:
Safe mode is going to be removed, eventually. Why do you need it on?

I don't need it, my host does. ;)

And, strictly speaking, not *my* host either - privately, I have
everything I could wish for, self-compiled PHP 5.2.0, MySQL 5.1, shell
access and no safe mode in sight.

At work, I labour with PHP 4.4, MySQL 4.0, safe mode and WebDAV access
only. Go figure...

--
CB