Re: [PHP] ini_set() security question

2007-06-01 Thread Richard Lynch
*I* agree, but my agreement don't mean much... :-v On Fri, June 1, 2007 10:13 am, Samuel Vogel wrote: > I just tried it with php 5.2.3. Same behavior! > > Do you agree that overwriting the value shouldn't be possible with > ini_set() ? > > I will file a bug report! > > Richard Lynch schrieb: >> Fi

Re: [PHP] ini_set() security question

2007-06-01 Thread Samuel Vogel
I don't think it should be allowed. A comment from the ini_set page [1]: "If you set something using php_admin_value in httpd.conf it is then not possible to be set the value at runtime, even if it's NOT PHP_INI_SYSTEM. " So, I guess it must be a bug. Tijnema [1] http://www.php.net/manual/en/

Re: [PHP] ini_set() security question

2007-06-01 Thread Tijnema
On 6/1/07, Samuel Vogel <[EMAIL PROTECTED]> wrote: I just tried it with php 5.2.3. Same behavior! Do you agree that overwriting the value shouldn't be possible with ini_set() ? I will file a bug report! I don't think it should be allowed. A comment from the ini_set page [1]: "If you set somet

Re: [PHP] ini_set() security question

2007-06-01 Thread Samuel Vogel
I just tried it with php 5.2.3. Same behavior! Do you agree that overwriting the value shouldn't be possible with ini_set() ? I will file a bug report! Richard Lynch schrieb: File a bug report then, and see what happens... But you may want to test with most recent versions if you are not al

Re: [PHP] ini_set() security question

2007-05-31 Thread Richard Lynch
File a bug report then, and see what happens... But you may want to test with most recent versions if you are not already on current PHP versions. On Thu, May 31, 2007 2:46 pm, Samuel Vogel wrote: > There is no bug filed for this. There is only one older bug ( > http://bugs.php.net/bug.php?id=388

Re: [PHP] ini_set() security question

2007-05-31 Thread Samuel Vogel
There is no bug filed for this. There is only one older bug ( http://bugs.php.net/bug.php?id=38804 ) which makes me think overwriting with ini_set() shouldn't be possible! Richard Lynch schrieb: On Wed, May 30, 2007 3:34 pm, Samuel Vogel wrote: And what happens if you try to allocate 3M of

Re: [PHP] ini_set() security question

2007-05-30 Thread Richard Lynch
On Wed, May 30, 2007 3:34 pm, Samuel Vogel wrote: >> And what happens if you try to allocate 3M of data? >> >> $foo = str_repeat('.', 3145728); >> > Nothing. It does it without any errors. I can allocate up to 20MB > (well > a little bit less of course). Check http://bugs.php.net and see if it's a

Re: [PHP] ini_set() security question

2007-05-30 Thread Samuel Vogel
Hi! Show us your test code? /etc/apache2/httpd.conf : php_admin_value memory_limit 3145728 iniset_test.php : new: ".$new; ?> The result is the following: old: 3145728 new: 20971520 -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] ini_set() security question

2007-05-30 Thread Samuel Vogel
And what happens if you try to allocate 3M of data? $foo = str_repeat('.', 3145728); Nothing. It does it without any errors. I can allocate up to 20MB (well a little bit less of course). Regards, Samy -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php

Re: [PHP] ini_set() security question

2007-05-30 Thread Richard Lynch
On Wed, May 30, 2007 2:59 pm, Samuel Vogel wrote: > Hi! >> Show us your test code? >> > /etc/apache2/httpd.conf : > php_admin_value memory_limit 3145728 > > iniset_test.php : > > $old = ini_set("memory_limit", 20971520); > > echo "old: ".$old; > > $new = ini_get("memory_limit"); > > echo "new: ".$

Re: [PHP] ini_set() security question

2007-05-30 Thread Richard Lynch
On Wed, May 30, 2007 2:44 pm, Samuel Vogel wrote: >>> I would like to allow the users to ini_set(), while disabling the >>> risky >>> options with php_admin_flag/value! >>> >> >> I don't think php_admin_* can be over-ridden -- that's kinda the >> whole >> point of that. > > The Problem is, that i

Re: [PHP] ini_set() security question

2007-05-30 Thread Samuel Vogel
Hello, I would like to allow the users to ini_set(), while disabling the risky options with php_admin_flag/value! I don't think php_admin_* can be over-ridden -- that's kinda the whole point of that. The Problem is, that i can be overwritten using ini_set()... I just found that out by t

Re: [PHP] ini_set() security question

2007-05-30 Thread Richard Lynch
On Tue, May 29, 2007 10:19 am, Samuel Vogel wrote: > I would be very interested in knowing which options, that are > accessible > with PHP_INI_ALL or PHP_INI_PERDIR, could be risky to allow on a > shared > hosting server. php.ini_recommended is a good starting point, I think... > I would like to