有没有可以在共享主机上安全使用的 PHP 框架？
是否有 PHP 框架允许我生成应用程序，然后在共享主机上安全地使用它，只要可以实现共享主机的安全性？我的意思是，例如，不需要任何具有 777 访问权限的 app/tmp 目录。
不是 Symfony -> http://trac.symfony-project.org/wiki/SharedHostingNotSecure
不是 CakePHP -> ; http://book.cakephp.org/view/911/Permissions
CodeIgniter -> “如果您是一名开发人员，生活在共享托管帐户和有截止日期的客户的现实世界中......” - 看起来很有希望，也许是这个？但我在文档中找不到任何特定于共享托管文件权限的内容
也许是 ZendFramework？ （我不确定它是否与 PHP 框架属于同一类别，看起来像）
任何现有的可能框架可以在共享托管上安全使用？
Are there PHP frameworks that would allow me to generate an application and then use it SECURELY on a shared hosting, as far as a shared hosting security can be achieved? By this I mean, for example, not requiring any app/tmp directory with 777 access.
Not Symfony -> http://trac.symfony-project.org/wiki/SharedHostingNotSecure
Not CakePHP -> http://book.cakephp.org/view/911/Permissions
CodeIgniter -> "If you're a developer who lives in the real world of shared hosting accounts and clients with deadlines..." - looks promising, maybe this one? But I couldn't find anything specific to shared hosting file permissions in the documentation
Maybe ZendFramework? (I am not sure if it is the same category as PHP framework, looks like)
Any existing possible frameworks to use SECURELY on shared hosting??
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
必须声明具有
777权限的目录只是廉价和入门级共享主机系统上的问题。在该区域经常会看到 safe_mode hack 和 openbasedir 限制，这些限制仅阻止通过 PHP 进行访问，但不会阻止其他 CGI 解释器的访问。现代服务器设置使用 suexec/suphp，其中每个 PHP 脚本都在当前帐户权限下运行。因此，您不需要任何全局写入目录，并且大多数 PHP 应用程序至少应该能够防止跨帐户篡改。框架本身在这里没有什么区别。
Having to declare directories with
777permissions is only a problem on cheapo and entry-level shared hosting systems. It's common to see the safe_mode hack and openbasedir restrictions in that area, which only prevent access via PHP but not other CGI interpreters.Contemporary server setups use suexec/suphp, where every PHP scripts runs under the current accounts permissions. Therefore you don't need any world-write directories and most PHP application should be secure against cross-account tampering at least. The framework itself doesn't make a difference here.
你正在从错误的角度看待正确的问题。
拥有权限为 777 的目录本身并不是不安全的。
在共享主机上拥有 777'ed 目录是不安全的，因为 http 守护进程是在同一系统帐户下为所有客户端运行的。
这是共享主机的固有“功能”，这就是为什么它是最便宜的。是的，它不是无缘无故地便宜，而是以安全为代价的便宜。
如果安全对您来说很重要，请购买 VPS。现在 VPS 已经足够便宜了。
You're looking at the right problem from the wrong point of view.
Having a directory with the rights 777 is not unsecure per se.
Having a 777'ed directory on a shared hosting is unsecure, because the http daemon is run for all clients under the same system account.
It is an intrinsic "feature" of shared hosting, that's why it's the cheapest. Yep, it's not cheap for nothing, it's cheap at the price of security.
If security is that important to you, buy a VPS. Nowadays VPSes are cheap enough.
我建议Zend Framework。据我所知，不需要任何文件权限。只需要一些适当的配置。是的，它是一个 PHP 框架。我的整个库都在 root 所有者之下，每个人都有读取权限，并且工作正常。从来不需要 chmod 任何东西。当涉及到库时，如果类需要，您始终可以定义自己的 tmp 路径。
I suggest Zend Framework. Doesn't require any file permissions as far as I know. Just needs some proper configuration. And yes, it is a PHP Framework. My entire library is under root owner, with read permissions for everyone and it works fine. Never needed to chmod anything. When it comes to libraries you can always define your own tmp path if it's needed by the class.
大多数成功的攻击都是因为用户/管理员坚持默认设置而发生的；这是众所周知的。请参阅 Windows 攻击。令人难以置信的是，有多少“管理员”不仅保留默认 URL、默认目录结构，还保留用户 ID 和密码。在我的网站上，我反复看到一些登录尝试在 /wp-login.php 上使用 ID:PW 作为 admin:admin。我什至不知道这些是否是默认设置，我的网站甚至不是 WP，但似乎是，我认为那些黑客偶尔会很幸运。
我相信安全始终是提高标准，使其变得更加困难。永远没有 100% 的安全保证。我认为您可以选择任何框架或应用程序，但您的工作是通过更改默认值来使其变得更加困难。
我只能代表 ZF，你可以做一些没人能猜到的怪异配置；除非您的应用程序偶尔出现错误，并且您显示错误消息并包含完整信息。
Most successful attacks happen because the user/admin sticks with the defaults; which are well-known. See Windows attacks. It's unbelievable how many "administrators" keep not only default URLs, default directory structures but also User IDs and passwords. On my website I see repeatedly some log in attempts at /wp-login.php with ID:PW as admin:admin. I don't even know if these are some defaults and my website is not even WP but it seems to be and I think those hackers will get lucky every once in a while.
Security I believe is always about raising the bar, make it more difficult. There is never a 100% guarantee of security. I think you can choose whatever framework or application but it is your job to make it more difficult by changing the defaults.
I can only speak for ZF and you can do some freaky configuration nobody will ever guess; unless your application has occasional errors and you show your error messages with full information.