Sec Bug->Doc #65289 [Opn]: disable_functions per domain not working

Edit report at https://bugs.php.net/bug.php?id=65289&edit=1 ID: 65289 Updated by: johannes@php.net Reported by: markku dot niskanen at gmail dot com Summary: disable_functions per domain not working Status: Open -Type: Security +Type: Documentation Problem Package: FPM related Operating System: Centos 6.2 PHP Version: 5.5.0 Block user comment: N Private report: Y New Comment: The documentation should be made clearer. http://php.net/manual/en/ini.core.php#ini.disable-functions mentions "php.ini only" while it should be "global php.ini" or something along the lines. The setting is read during startup only not on every request. Previous Comments: ------------------------------------------------------------------------ [2013-07-18 15:07:07] markku dot niskanen at gmail dot com Description: ------------ NOTE: If this is a feature and not a bug it should be in the documentation. Using domain specific php.ini disable_functions setting does not work. Using the settings below I can still run phpinfo(). I can actually see that the settings should prevent me running it as they are there! The master value of disable_functions is an empty string. When the setting is applied as a master value it prevents running the functions correctly. Tested with Centos 6.2 & Centos 5.4 and PHP 5.5.0 (php-fpm). Test script: --------------- # php.ini settings: # end of php.ini std stuff, host specific stuff starts [HOST=testdomain.com] upload_max_filesize=7M disable_functions=phpinfo,exec,shell_exec,system,passthru code: <?php phpinfo(); echo exec('whoami'); Expected result: ---------------- (empty page) Actual result: -------------- FULL phpinfo() page plus the user name! result copied from browser : disable_functions phpinfo,exec,shell_exec,system,passthru upload_max_filesize 7M So the settings are there but not working. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=65289&edit=1