Sec Bug->Req #79324 [Opn]: Alternative to safe_mode_protected_env_vars

Edit report at https://bugs.php.net/bug.php?id=79324&edit=1 ID: 79324 Updated by: stas@php.net Reported by: diego dot blanco at treitos dot com Summary: Alternative to safe_mode_protected_env_vars Status: Open -Type: Security +Type: Feature/Change Request -Package: PHP Language Specification +Package: Scripting Engine problem PHP Version: 7.4.3 Block user comment: N Private report: Y Previous Comments: ------------------------------------------------------------------------ [2020-02-29 18:45:25] diego dot blanco at treitos dot com Description: ------------ In old versions of PHP it was possible to prevent end users to set sensitive environment variables such as LD_PRELOAD or LD_LIBRARY_PATH using safe_mode_protected_env_vars. After safe_mod was deprecated I cannot find any way of doing this. The only workaround is to absolutely disable the putenv function. Is this feature hidden anywhere? If so, it might be good to update the documentation and add links in this page: https://www.php.net/manual/en/ini.sect.safe-mode.php#ini.safe-mode-protected-env-vars If it is not, I think this should be implemented. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79324&edit=1