Bug #68092 [NEW]: chmod still works after being disabled via disable_functions

From: software-php at interfasys dot ch Operating system: FreeBSD PHP version: 5.4.33 Package: PHP options/info functions Bug Type: Bug Bug description:chmod still works after being disabled via disable_functions Description: ------------ I'm using PHP-FPM 5.4.33 In a secondary ini file add a section which will apply to one website and disable chmod [HOST=my.web.site] disable_functions = "chmod" Check that the function is disabled via phpinfo() In my case, the local value for disable_functions shows "chmod" Create a simple script which chmods a file Test script: --------------- if (!ini_get('display_errors')) { ini_set('display_errors', '1'); } echo ini_get('display_errors'); echo "I am chowning a file"; chmod("testcase.php", 0777); Expected result: ---------------- I should get an error message telling me that this is not allowed Actual result: -------------- The file is chowned to 777. Not that if the same function is added to Suhosin's blacklist, then I will get the proper warning: "Warning: chmod() has been disabled for security reasons" -- Edit bug report at https://bugs.php.net/bug.php?id=68092&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68092&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68092&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68092&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68092&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68092&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68092&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68092&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68092&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68092&r=support Expected behavior: https://bugs.php.net/fix.php?id=68092&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68092&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68092&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68092&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68092&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68092&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68092&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68092&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68092&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68092&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68092&r=mysqlcfg