php class limit access

[korazy]

I have a PHP app that I would like to allow users to write custom extensions for.  I currently only allow my hosted solution, so for me to allow users to upload custom PHP classes as extensions, I need to limit the functionality of those classes.  I would want to make sure they don't have any access to the database, file system, etc.

 

The custom PHP classes would have to interface one of my interface classes so all data/information the custom class would need is passed when called.

 

Is there a way to do this?

 

[requinix]

As soon as you allow people to write custom PHP code that interacts with yours, the security of your application is lost entirely.

 

My advice: document a set of APIs (interfaces) and rules custom code must follow, then allow them to submit it to you for a manual screening and approval process.

[vinny42]

 

As soon as you allow people to write custom PHP code that interacts with yours, the security of your application is lost entirely.

 

+435

 

And besides that ; PHP simply doesn't have any way to control accessrights on a per-script basis. You can configure PHP per webserver instance, but then your code would have to obey the same restrictions.

 

 

document a set of APIs (interfaces) and rules custom code must follow, then allow them to submit it to you for a manual screening and approval process. 

 

And even then there's a very good chance that you miss somthing as simple as a memory leak, or an fsock that acts ike a fileserver to warez sites.

 

Nah, keep the customer's code on the customer's site. Give them an HTTP-based API so they can request information and send new data to your application but do *NOT* let them run their own code on your server.