fopen a danger

[brendan3eb]

Today, I used the fopen() in one of my pages and I received the following error "Warning: fopen(): URL file-access is disabled in the server configuration". So I asked my server admin to enable the fopen function and he told me that it enabling it would be a security threat. I don't know what the security threat is, but I'm sure that most people here do, is there a way for my server admin to configure the server so that the fopen function is not a security threat? If not, is there another function I can use in my rss reader pages.

[ergophobe]

Basically, your host has chosen to run the server using safe mode [us3.php.net] which affects some functions [us3.php.net], restricting some and disabling others.

fopen is not actually disabled, but merely restricted. In particular, when running in safe mode, PHP,

Checks whether the directory in which you are about to operate has the same UID (owner) as the script that is being executed.

Now here's where I get a bit confused, since I have never had to deal with a server running in safe mode, but I think it goes sort of like this. Since the PHP process is usually "owned" by the user "nobody", this must be the user who owns the directory as well. So you would have to set the owner to "nobody" (see the man page for "chown" [hmug.org]). The problem is that a server with safe_mode in effect restricts use of the php chown [php.net] function and, probably has other restrictions in effect that prevent you from beign able to work around it (i.e., you probably don't have the rights to use the chown shell command).

Like I say, take the above with a grain of salt, since I've never actually dealt with it, so I've never paid much attention to it and my knowledge (or lack thereof) is purely theoretical.

Good luck and hopefully someone with more knowledge will chime in.

[davelms]

Same with my host. fopen() and similar techniques restricted in PHP. Although as I understand, it works if you use Perl instead of PHP. However, they are willing to accept URLs or IPs - which they then vet - and open then up within an hour or so of a request. So typically requests will be for the likes of Amazon, Google, Paypal, etc. So whatever it is, it appears "configurable" with my host allowing some URLs through on request and denying access to others being the default. Unless your host acts in a similar way, maybe you can have a look at a Perl RSS script perhaps?

[dmorison]

Do you know if fsockopen() [uk.php.net] is also restricted?

The first user-contributed note on the manual page has a fetchURL function - you could try that...

[henry0]

Ergophobe is right

Checks whether the directory in which you are about to operate has the same UID (owner) as the script that is being executed

I had once the same problem the answer lies in ownership

Although if you are using fopen as a constructing tool
(I mean once in the process of installing new files and processing some modifications for ex) then ask the admin to open the door for having one shot at it (in my case they did it)
Otherwise It seems that there is no back door
Although I would be interested in knowing how dmorison solution does

[genusapiens]

rss reader? are you trying to read from external rss sources? you can try using file_get_contents() or file() whichever is suitable (or whichever one works).

[brendan3eb]

I told my server admin that I was only using the function for an rss feed and he enabled it for my account only and said the reason he disabled it was that if I used it with forms where the user can choose certain things that it would be too much of being hacked.