Difference between revisions of "Why shouldn't you use PHP safe mode?"

From Joomla! Documentation

m (clean up categories with <noinclude> tags)
m (added category)
Line 23: Line 23:
 
[[Category:Version 1.5 FAQ]]
 
[[Category:Version 1.5 FAQ]]
 
[[Category:Version 1.6 FAQ]]
 
[[Category:Version 1.6 FAQ]]
[[Category:Version 1.7 FAQ]]</noinclude>
+
[[Category:Version 1.7 FAQ]]
 +
[[Category:Server configurations]]</noinclude>

Revision as of 06:52, 19 October 2012

Overview

Enabling safe_mode is not needed if other reasonable security precautions are followed. Using safe_mode for web site security is a poor compromise in a bad situation. It may make sense in some situations, but there is almost always a better way. Because safe_mode in some sense only gives the illusion of safety, it will be removed from PHP starting with version 5.3.0.

The Joomla! core works fine with or without PHP safe_mode. The one exception to this rule is the installation script. This is because safe_mode, by design, turns off the PHP functions that enable easy uploading via a Web browser. If you do use safe_mode, and need to perform installs via the Web browser, temporarily turn safe_mode OFF, and turn it back ON when finished.

Some third-party extensions may require the specific PHP functions that are blocked by safe_mode. Such extensions should be carefully evaluated to be sure you understand exactly why they require such powerful and potentially dangerous functions.

From the official PHP site

"The PHP safe mode is an attempt to solve the shared-server security problem. It is architecturally incorrect to try to solve this problem at the PHP level, but since the alternatives at the web server and OS levels aren't very realistic, many people, especially ISP's, use safe mode for now." More Information

  1. Official PHP Manual: PHP Security and Safe Mode Configuration Directives
  2. Official PHP Manual: PHP Functions restricted/disabled by safe mode