so I'm planning to have a PHP site being able to execute a java app using exec()....
my question is, where should I store the actual jar file for the java app, should I put them in one of the folders in Apache's www, or should I put them in an outside folder that is inaccessible by apache
does it even matter? I'm concerned with the security implications of these choices....
分享 When you use Java using exec from php you run it on behalf of Apache user. So IMHO this directory can be accessible to Apache. However (as pointed by dog in comment), it should not be in Apaches DocumentRoot or the .jar file must not be accessible by HTTP.
IMHO better architecture can contain another Java server (lightweight Jetty or Tomcat) exposing web service (restfull or soap). Your site should call this web service on Java server. Another way is putting queue manager beetween them (or simply create queue in database). There are lot of better solutions.
分享
