I installed Apache with FastCGI (mod_fastcgi), suExec and PHP on my local development box. Working perfectly, except one thing.
Let's say I have two users:
user1 - /home/user1/public_html user2 - /home/user2/public_html
I discovered a serious security hole in my configuration: I can include a file from user2 web root in user1 file. How to prevent? Any tips?
php-cgi process is running under correct user.