www-data, I want to use suPHP. My idea is to create an intermediate script, lets call it
load.php, which takes as an argument the user's target script, lets call it
load.php then checks to see if the user owns
target.php, and if they do, launches
But then what's to stop the user from within
target.php issuing a command like (I am not sure if this example is accurate as I can't find any documentation on suPHP).
Does suPHP need a user's password to execute these scripts?
Janne Pikkarainen pointed out that suPHP starts as root, then switches to the owner of a file before executing it. So now I have two questions.
- If the PHP script that's executed by suPHP (as the owner, lets call him user1) in turn contains
shell_exec("php /home/user2/test.php");, will this return an error since user1 is trying to launch user2's script, or will suPHP kick in again and change from user1 to user2.
<form action="/home/user2/test.php" method="get">?