Bug #72253 [Nab]: phpinfo shows only first block of admin_value[disable_functions]

Edit report at https://bugs.php.net/bug.php?id=72253&edit=1 ID: 72253 User updated by: witekfl at gazeta dot pl Reported by: witekfl at gazeta dot pl Summary: phpinfo shows only first block of admin_value[disable_functions] Status: Not a bug Type: Bug Package: FPM related Operating System: Linux PHP Version: 7.0.6 Block user comment: N Private report: N New Comment: php_admin_value[disable_functions] = leak php_admin_value[disable_functions] = phpinfo php_admin_value[disable_functions] = exec <?php error_reporting(E_ALL); phpinfo(); Warning: phpinfo() has been disabled for security reasons in /home/www/info.php on line 3 Could you check it first, please? Previous Comments: ------------------------------------------------------------------------ [2016-05-22 21:04:07] requinix@php.net php_admin_value defines a setting that cannot be overridden. The second line is ignored because it is attempting to override the disable_function set earlier. disable_functions is a comma-separated list of functions. Your configuration should read php_admin_value[disable_functions] = curl_init,curl_close http://php.net/manual/en/ini.core.php#ini.disable-functions ------------------------------------------------------------------------ [2016-05-22 20:45:10] witekfl at gazeta dot pl Description: ------------ phpinfo's disable_functions displays only first block of php_admin_value[disable_functions]. Test script: --------------- php_admin_value[disable_functions] = curl_init php_admin_value[disable_functions] = curl_close <?php phpinfo(); Expected result: ---------------- phpinfo in disable_functions displays curl_init, curl_close Actual result: -------------- curl_init ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72253&edit=1