[PHP5] Will be security be enforced ?

[Julien Buratto]

I don't think Php, setting safe_mode and register globals did a serious job
on 4.1.x versions and above.

Actually I would like to see that crapy problems beeing solved on Php5 but
it seems nobody is thinking of it...

Any idea ?

Julien

[knocte]

Re: [PHP5] Will be security be enforced ?

Julien Buratto escribió:[color=blue]
> I don't think Php, setting safe_mode and register globals did a serious job
> on 4.1.x versions and above.
>
> Actually I would like to see that crapy problems beeing solved on Php5 but
> it seems nobody is thinking of it...
>
> Any idea ?
>
> Julien
>
>[/color]

What do you understand by crapy problems?

Regards,

knocte

[Julien Buratto]

Re: [PHP5] Will be security be enforced ?

> What do you understand by crapy problems?

With 'crapy problems' I mean something like inability to let my script
create files on the userspace in a webhosting environment to let a script
work
without create the file/modify permission via php_ftp functions ...
All this happens when you do install php with the default options...

Julien

[Phil Roberts]

Re: [PHP5] Will be security be enforced ?

With total disregard for any kind of safety measures "Julien
Buratto" <juliencancella qui@linkas.it> leapt forth and uttered:
[color=blue][color=green]
>> What do you understand by crapy problems?[/color]
>
> With 'crapy problems' I mean something like inability to let my
> script create files on the userspace in a webhosting environment
> to let a script work
> without create the file/modify permission via php_ftp functions
> ... All this happens when you do install php with the default
> options...
>
> Julien
>
>
>[/color]

This has nothing to do with PHP. It is a restriction imposed by
*nix filesystem permissions.

As with every programming language, the burden of writing secure
code lies ultimatly with the developer. The vast majority of PHP
script security issues are the result of ignorance on the part of
the author. As you have unfortunatly proved with the rather large
misconception you just put forward.

--
There is no signature.....

[Julien Buratto]

Re: [PHP5] Will be security be enforced ?

> >> What do you understand by crapy problems?[color=blue][color=green]
> >
> > With 'crapy problems' I mean something like inability to let my
> > script create files on the userspace in a webhosting environment
> > to let a script work
> > without create the file/modify permission via php_ftp functions
> > ... All this happens when you do install php with the default
> > options...
> >
> > Julien
> >[/color]
>
> This has nothing to do with PHP. It is a restriction imposed by
> *nix filesystem permissions.
>
> As with every programming language, the burden of writing secure
> code lies ultimatly with the developer. The vast majority of PHP
> script security issues are the result of ignorance on the part of
> the author. As you have unfortunatly proved with the rather large
> misconception you just put forward.
>[/color]

Well this depens only in the experience taken with jsp in wich so many
security problems are
solved on the underlying level because the filosophy is that the programmer
should be much more involved
in real programming than in being aware not to introduce security holes.
Infact, what I would like to understand if other devlopers do feel the same
'security loneliness' as I do.

Julien

[Wayne]

Re: [PHP5] Will be security be enforced ?

On Tue, 06 Jan 2004 10:27:45 GMT, "Julien Buratto"
<juliencancella qui@linkas.it> wrote:
[color=blue][color=green]
>> What do you understand by crapy problems?[/color]
>
>With 'crapy problems' I mean something like inability to let my script
>create files on the userspace in a webhosting environment to let a script
>work
>without create the file/modify permission via php_ftp functions ...
>All this happens when you do install php with the default options...[/color]

As has been said already, this is unix file permission issue. If you
give a directory the appropriate permissions you will be able to write
to it.

Safe_mode is for paranoid hosts. And register globals (off) simply
removes a particularily bad feature of early versions of PHP.

Other than that, the security concerns of PHP are no different from
any other web development platform.