Charles, this leads to another question that might more fully answer the previous.
If In a Shared environment (non phpsuexec). What ARE the vulnerabilities with regards to file viewing, modifying, executing and permissions?
If I have a file that is 777, in a directory that is 777. Can someone else on the VPS view, modify, exec that file? (non phpsuexec). What about WITH phpsuexec, is any of that possible?
The question is a bit loaded, as 777 permissions are just plain stupid, and there is not just php you have to worry about, but I'll explain the scenarios.
1. You somehow were foolish enough to give your use ssh access, and not jailed to their home directory - then yes they can access the files either way.
2. You user has no ssh access, or jailed ssh access, and only panel/ftp access which jails them (standard) then no they cannot with PHPsuexec enabled. If you are not using phpsuexec, and a malicious user knows the paths to these files, they could indeed modify and access files with these permissions. In fact any file or directory owned by the apache user (nobody for example) or in the apache group (again nobody for example) is at a minimum readable by other php scripts on that server. For example:
<?php
$dir='/home/c******/public_html';
if ($handle = opendir($dir)) {
echo "<pre>Files:\n";
while (false !== ($file = readdir($handle))) {
echo "$file\n";
if ( $file == "test.php" )
{
print_r(file("$dir/$file"));
}
}
echo "</pre>";
closedir($handle);
}
?>
So don't use the same password for databases etc in your scripts, as you use for your accounts, etc.
I think this would help people make better decisions about phpsuexec.
Trusting clients isn't always wise or possible, so you need to know the risks and vulnerabilites and how to limit them.
You said the word "client". Say no more, and enable PHPsuexec. :)
charles