.htaccess and restricting fopen to current directory

[mwylde]

Hey there. I want to start a small host just for some members of a website I have but have ran into a problem.

If the member was to make a PHP file to fopen (../../otheruser/files) they could get into other peoples hosting areas.

I am on a reseller hosting plan with cPanel/WHM and have access to .htaccess. I would like to know if it is possible to keep all scripts in a certain folder to that folder/subfolders and not be able to break out of it and access others areas.

Thanks for the help
Mark

[sabai]

You want to do something like this:

php_admin_value open_basedir /var/www/dir
php_admin_flag safe_mode on

But you can't do this in php.ini, I believe ;-) Otherwise people could just override it.

You must do it in the part of your apache config files relating to the virtual host. May not be possible if you are on a reseller account. However, you can ask your host to do it and if they have any sense they will do it for you.