1

I have php installed trough a fastCGI module.

Is there a way to restrict the module (php.exe) read / write permissions to only the directory (+ subdirs) of the IIS site that is calling it?

I need this to prevent one IIS PHP site from having access to files outside its own directory.

How to do this? Is there a setting in php.ini or in the IIS configuration?

I believe such a feature could exist, because when a file on the server is requested the root path of the site is also known, all it would take is that IIS passes this path to the php module, and the php module should on its end allow only IO operations within this path.

PS: I know it is possible to achieve this by using a different windows account for each website, this is not an option.

Improve this question
2
  • Why is using a different account per website not an option? I think most solutions would involve a different app domain per site anyway. In theory something could be done to reduce the privileges of the php-cgi.exe process itself, but it seems like it should be done to the app domain worker process.
    – Justin Dearing
    Feb 22, 2011 at 15:59
  • What version of windows, and what version of PHP?
    – Justin Dearing
    Feb 22, 2011 at 16:00

1 Answer 1

Reset to default
0

Hopefully this isn't too little, too late...

You should be able to use the PHP directive open_basedir to do what you want. See this section in the docs how to configure IIS to use it: http://learn.iis.net/page.aspx/246/using-fastcgi-to-host-php-applications-on-iis-70/#Per-site_PHP_configuration

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .