[linux-security] Re: php3 module and security

["Levy Carneiro Jr." <levy fractal com br>]

At 11:11 08/05/99 -0700, you wrote:
>Files in any web directory with the extention .php3 will be interpreted,
and no
>others will be unless specified to do so.  How is this a security breach?

	If a user in a ISP create a file .php3 with read/write functions, 
he'll have permissions to read/overwrite some private files.
I need a way to specify which directory will be viewed by the parser.

	In the php3.ini file there are some directives, but only for binary mode 
of using php3, not as module in apache.


	Thanks,
	lacj

---
<levy null net>
Levy Carneiro Jr.
Linux & Network Admin