Req #62397 [Com]: disable_functions = eval does not work

Edit report at https://bugs.php.net/bug.php?id=62397&edit=1 ID: 62397 Comment by: jake at qzdesign dot co dot uk Reported by: spamik at yum dot pl Summary: disable_functions = eval does not work Status: Closed Type: Feature/Change Request Package: *General Issues PHP Version: 5.3.14 Assigned To: krakjoe Block user comment: N Private report: N New Comment: @krakjoe > There is no difference between eval and include This is not true. If malicious code were required to write a file to be !included, this could be monitored and potentially blocked by a separate tool running at the filesystem level. > By the time a hacker has permission to execute unsafe code via eval or by any other means, it > is too late. Isn't that a bit like saying 2FA is pointless because by the time your password has been cracked it's too late? Previous Comments: ------------------------------------------------------------------------ [2019-06-03 09:30:54] krakjoe@php.net There is no implementation of this that can provide any security. There is no difference between eval and include, if a malicious hacker finds themselves on a system where eval is disabled, they can just dump what they would eval and include it. By the time a hacker has permission to execute unsafe code via eval or by any other means, it is too late. ------------------------------------------------------------------------ [2019-06-03 09:24:07] petk@php.net Re-opened bug and we're back at the beginning via above revert so when that will be more properly fixed we can move forward here I guess. ------------------------------------------------------------------------ [2019-06-03 09:20:32] krakjoe@php.net Automatic comment on behalf of krakjoe Revision: http://git.php.net/?p=php-src.git;a=commit;h=ff96f25b12287de8105305b6f92c7714833066a7 Log: Revert "Fix bug #62397 - disable_functions does not work with eval." ------------------------------------------------------------------------ [2019-05-14 22:00:26] petk@php.net Automatic comment on behalf of kontakt@beberlei.de Revision: http://git.php.net/?p=php-src.git;a=commit;h=050d299364ded5cb7b878bc515aa763c9c623c4b Log: Fix bug #62397 - disable_functions does not work with eval. ------------------------------------------------------------------------ [2019-04-28 15:57:31] beberlei@php.net The following pull request has been associated: Patch Name: Fix bug #62397 - disable_functions does not work with eval. On GitHub: https://github.com/php/php-src/pull/4084 Patch: https://github.com/php/php-src/pull/4084.patch ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=62397 -- Edit this bug report at https://bugs.php.net/bug.php?id=62397&edit=1