LinkBack URL
About LinkBacks
php open_basedir pointless?
WHM: Main >> Server Setup >> Tweak Security
Php open_basedir Tweak
I don't see the point of enabling this unless you are going to disable functions such as system(), passthru(), exec() etc... The reason for this is because cPanel/WHM runs under its own version of php in which php open_basedir is NOT disabled!!Php's open_basedir protection prevents users from opening files outside of their home directory with php.
Example 1:
If you were to upload this into public web space with php open_basedir enabled and visit the url, say: http://www.yourdomain.com/script.php?user=cpuser where cpuser = a cPanel username then you will only be allowed to view the contents of that public directory only if you set cpuser as the username associated with yourdomain.com.PHP Code:<?php
$directory = '/home/'.$_GET['user'].'/public_html';
$dirhandle = opendir($directory);
while ($files = readdir($dirhandle)) :
header('Cache-control: private'."\r\n");
header('Content-Type: text/plain'."\r\n");
header('Content-Disposition: inline; filename=dirlist.txt'."\r\n");
header('Content-transfer-encoding: ascii'."\r\n");
header('Pragma: no-cache'."\r\n");
header('Expires: 0'."\r\n\r\n");
echo $files."\r\n";
endwhile;
?>
The above is fine, no problem, no risk to security, however...
Example 2:
This example executes the same kind of code except it checks for php open_basedir being enabled and if is, will parse it via the internal cPanel/WHM version of php instead where there is NO php open_basedir restrictions in placePHP Code:<?php
if(ini_get('open_basedir')) :
system('/usr/local/cpanel/3rdparty/bin/php -q '.$_SERVER['SCRIPT_FILENAME'].' '. $_GET['user']);
else :
if (!isset($_GET['user'])) $_GET['user'] = $argv[1];
$directory = '/home/'.$_GET['user'].'/public_html';
$dirhandle = opendir($directory);
while ($files = readdir($dirhandle)) :
header('Cache-control: private'."\r\n");
header('Content-Type: text/plain'."\r\n");
header('Content-Disposition: inline; filename=dirlist.txt'."\r\n");
header('Content-transfer-encoding: ascii'."\r\n");
header('Pragma: no-cache'."\r\n");
header('Expires: 0'."\r\n\r\n");
echo $files."\r\n";
endwhile;
endif;
?>
Summary:
Unless you are going to disable all of PHP's ability to execute external programs or php open_basedir is disabled on cPanel/WHM version of it (will break lots of things including Fantastico) then it seems to me that having this enabled in the first place is pretty pointless?
Reply With Quote
Originally Posted by LP-Trel
