Re: [PHP] ini_set() security question

*I* agree, but my agreement don't mean much... :-v On Fri, June 1, 2007 10:13 am, Samuel Vogel wrote: > I just tried it with php 5.2.3. Same behavior! > > Do you agree that overwriting the value shouldn't be possible with > ini_set() ? > > I will file a bug report! > > Richard Lynch schrieb: >> Fi

Re: [PHP] ini_set() security question

I don't think it should be allowed. A comment from the ini_set page [1]: "If you set something using php_admin_value in httpd.conf it is then not possible to be set the value at runtime, even if it's NOT PHP_INI_SYSTEM. " So, I guess it must be a bug. Tijnema [1] http://www.php.net/manual/en/

Re: [PHP] ini_set() security question

On 6/1/07, Samuel Vogel <[EMAIL PROTECTED]> wrote: I just tried it with php 5.2.3. Same behavior! Do you agree that overwriting the value shouldn't be possible with ini_set() ? I will file a bug report! I don't think it should be allowed. A comment from the ini_set page [1]: "If you set somet

Re: [PHP] ini_set() security question

I just tried it with php 5.2.3. Same behavior! Do you agree that overwriting the value shouldn't be possible with ini_set() ? I will file a bug report! Richard Lynch schrieb: File a bug report then, and see what happens... But you may want to test with most recent versions if you are not al

Re: [PHP] ini_set() security question

File a bug report then, and see what happens... But you may want to test with most recent versions if you are not already on current PHP versions. On Thu, May 31, 2007 2:46 pm, Samuel Vogel wrote: > There is no bug filed for this. There is only one older bug ( > http://bugs.php.net/bug.php?id=388

Re: [PHP] ini_set() security question

There is no bug filed for this. There is only one older bug ( http://bugs.php.net/bug.php?id=38804 ) which makes me think overwriting with ini_set() shouldn't be possible! Richard Lynch schrieb: On Wed, May 30, 2007 3:34 pm, Samuel Vogel wrote: And what happens if you try to allocate 3M of

Re: [PHP] ini_set() security question

On Wed, May 30, 2007 3:34 pm, Samuel Vogel wrote: >> And what happens if you try to allocate 3M of data? >> >> $foo = str_repeat('.', 3145728); >> > Nothing. It does it without any errors. I can allocate up to 20MB > (well > a little bit less of course). Check http://bugs.php.net and see if it's a

Re: [PHP] ini_set() security question

Hi! Show us your test code? /etc/apache2/httpd.conf : php_admin_value memory_limit 3145728 iniset_test.php : new: ".$new; ?> The result is the following: old: 3145728 new: 20971520 -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] ini_set() security question

And what happens if you try to allocate 3M of data? $foo = str_repeat('.', 3145728); Nothing. It does it without any errors. I can allocate up to 20MB (well a little bit less of course). Regards, Samy -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php

Re: [PHP] ini_set() security question

On Wed, May 30, 2007 2:59 pm, Samuel Vogel wrote: > Hi! >> Show us your test code? >> > /etc/apache2/httpd.conf : > php_admin_value memory_limit 3145728 > > iniset_test.php : > > $old = ini_set("memory_limit", 20971520); > > echo "old: ".$old; > > $new = ini_get("memory_limit"); > > echo "new: ".$

Re: [PHP] ini_set() security question

On Wed, May 30, 2007 2:44 pm, Samuel Vogel wrote: >>> I would like to allow the users to ini_set(), while disabling the >>> risky >>> options with php_admin_flag/value! >>> >> >> I don't think php_admin_* can be over-ridden -- that's kinda the >> whole >> point of that. > > The Problem is, that i

Re: [PHP] ini_set() security question

Hello, I would like to allow the users to ini_set(), while disabling the risky options with php_admin_flag/value! I don't think php_admin_* can be over-ridden -- that's kinda the whole point of that. The Problem is, that i can be overwritten using ini_set()... I just found that out by t

Re: [PHP] ini_set() security question

On Tue, May 29, 2007 10:19 am, Samuel Vogel wrote: > I would be very interested in knowing which options, that are > accessible > with PHP_INI_ALL or PHP_INI_PERDIR, could be risky to allow on a > shared > hosting server. php.ini_recommended is a good starting point, I think... > I would like to

[PHP] ini_set() security question

I would be very interested in knowing which options, that are accessible with PHP_INI_ALL or PHP_INI_PERDIR, could be risky to allow on a shared hosting server. I would like to allow the users to ini_set(), while disabling the risky options with php_admin_flag/value! Stuff like 'memory_limit'