4 ms·
PHP was never receiving requests directly from the Internet. It was always a standard practice to talk to PHP trough a server. The separation between what you c
by Isinlor 7y ago
PHP was never receiving requests directly from the Internet. It was always a standard practice to talk to PHP trough a server. The separation between what you call deploy and run user is what you get as default by using Nginx or Apache on Ubuntu (root vs. www-data). If you feel very paranoid and don't mind some complexity you can put PHP code into a docker container and run it from there. In that setup, attacker targeting PHP code would need to break out of docker container to take full control over the server.
- theamk 7y agoThat sounds nice -- but does this happens often in PHP world? Last PHP project I tried to install was OwnCloud, and it explicitly says (in [0]): > Your HTTP user must own the config/, data/, apps/ respectively the apps-external/ directories so that you can configure ownCloud, create, modify and delete your data files, and install apps via the ownCloud Web interface. [0] https://doc.owncloud.org/server/10.4/admin_manual/installation/installation_wizard.html#post-installation-steps https://doc.owncloud.org/server/10.4/admin_manual/installati...
- Isinlor 7y agoA lot of PHP apps allow you to install plugins from within the app itself, without going trough the whole process of deployment. The app has to modify it's own code in that scenario. This is independent from programming language. If you allow users to independently install plugins you will allow them to execute third-party code - it's true for all programming languages. I don't know ownCloud, but I would guess they have an option to disable plugin installation. And as I said, if you feel paranoid, you can install PHP apps in docker container: https://doc.owncloud.org/server/10.4/admin_manual/installation/docker/ https://doc.owncloud.org/server/10.4/admin_manual/installati...