Re: Information Disclosure with Invision Board installation (fwd)

[gossi () lab6 com (Gossi The Dog)]

On Wed, 25 Sep 2002, Ka wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> At Mittwoch, 25. September 2002 01:55 Rossen wrote:
> > Fortunately phpinfo() is disabled in safe mode, 
> > which is a must for a "production server".
>
> Good idea. But this is not happening on apache
> mod_php4 or am I missing something?
>
> - ------------ output from phpinfo() ----------
> PHP Version 4.0.6
> ...
> Directive     Local Value     Master Value
> ...
> safe_mode     On              On
> - ---------------------------------------------

I've checked this with PHP4 too, and get the same behaviour.  I presume 
phpinfo() can be disabled somewhere in the conf files for safe mode.  Is 
it by default, one wonders.