Ok, here is a major problem that I have encountered.
I run an Apache web server on W2K. There are only two user accounts. SYSTEM and ADMINISTRATOR.
The Web server and PHP run as SYSTEM user. The server also runs Virtual domains.
Now when I give PHP access to users on the server, the problem is they can modify, delete or do whatever they want to do to the server, because the SYSTEM account has almost full access on the whole computer.
So, basically they can delete any file on the drives regardless of where PHP is installed or where the server root is.
How can you give each virtual domain rights only in its own folder. I mean, if a PHP script is running from http://www.mysite.com/ then the PHP in that domain should not be able to access any files above its own root folder.
Do you know what I mean. If this can be done, (i think using user_dir) then I have not been able to figure it out yet. Any help will be appreciated.
Also, there should be a way of ALLOWING php to access files above the root folder for some selected domains. For example, the main domain should have a way to access the files in the apache folder so that new sub-domains or new domains can be added using a web control panel.
Basically, I want to be able to give and stop (both) php access above the root folder of any given domain.
Please help.
Regards
Gagan Walia
king@walia.com
