#21218 [Opn]: should be able to set a list of hidden environment vars

ID: 21218 User updated by: ari@alienhosting.com Reported By: ari@alienhosting.com Status: Open Bug Type: Feature/Change Request Operating System: Red Hat Linux 7.3 PHP Version: 4.3.0 New Comment: Hm, I didn't even know you could do that. But I don't want to prevent accessing of environment variables, really just prevent access of some, or at the very least be able to only turn _ENV off for phpinfo(). Previous Comments: ------------------------------------------------------------------------ [2002-12-27 14:27:51] philip@php.net On a related note fwiw, even if E is removed from the variables_order directive (so that $_ENV will not exist), one can still use getenv() to access the variables. ------------------------------------------------------------------------ [2002-12-27 13:55:14] ari@alienhosting.com Currently, safe_mode_protected_env_vars can be set to disallow setting of specific environment variables. I propose an option to set a list of environment variables (possibly with wildcards, such as SUDO_*) that are completely hidden from PHP pages, and do not show up in phpinfo() (Since you can disable environment variables, but to hide _ENV globals, you would have to disable variable listing completely, which is not always good enough). Showing certain environment settings are a huge security risk, such as SUDO_UID and SUDO_USER if apache was started using sudo, as well as PWD, PATH, SSH_CONNECTION, etc. Disabling phpinfo() is not always a possibility, since it gives a lot of useful information to users. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=21218&edit=1