I have php installed trough a fastCGI module.

Is there a way to restrict the module (php.exe) read / write permissions to only the directory (+ subdirs) of the IIS site that is calling it?

I need this to prevent one IIS PHP site from having access to files outside its own directory.

How to do this? Is there a setting in php.ini or in the IIS configuration?

I believe such a feature could exist, because when a file on the server is requested the root path of the site is also known, all it would take is that IIS passes this path to the php module, and the php module should on its end allow only IO operations within this path.

PS: I know it is possible to achieve this by using a different windows account for each website, this is not an option.

  • Why is using a different account per website not an option? I think most solutions would involve a different app domain per site anyway. In theory something could be done to reduce the privileges of the php-cgi.exe process itself, but it seems like it should be done to the app domain worker process. – Justin Dearing Feb 22 '11 at 15:59
  • What version of windows, and what version of PHP? – Justin Dearing Feb 22 '11 at 16:00

Hopefully this isn't too little, too late...

You should be able to use the PHP directive open_basedir to do what you want. See this section in the docs how to configure IIS to use it: http://learn.iis.net/page.aspx/246/using-fastcgi-to-host-php-applications-on-iis-70/#Per-site_PHP_configuration

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.