Re: How to disable some functions?

At 4:54 PM +0000 2/28/01, Philip Reynolds wrote:

Batonik's [weirdo@poczta.onet.pl] 15 lines of wisdom included: :>Hi, :> :> I've heard that it is possible, for security reasons, to disable :>such functions like phpinfo(). How can I do this? You can edit the sources... PHP4: $PHP_BASE_DIR/ext/standard/basic_functions.c You're looking for a struct called function_entry basic_functions[] On my version (4.0.4-pl1) it's on line 91. Your functions are listed there..

for example, delete line "PHP_FE(time,                  NULL)"

which is on line 100 on my version disables the time function. However, why you want to disable functions is beyond me, to make PHP "safe" you're going to have to disable a LOT of functions.. There might be some PHP4 way to disable functions, I think there might be some way to do it from php.ini, but I can't find it offhand. Phil.

It's not documented yet at http://www.php.net/manual/en/configuration.php , but you can use the following in your php.ini file: disable_functions = ; This directive allows you to disable certain ; functions for security reasons. It receives ; a comma separated list of function names. ; This directive is *NOT* affected by whether ; Safe Mode is turned on or off. I presume you could use the php_value disable_functions phpinfo syntax in your httpd.conf or .htaccess (you might need to use php_admin_value instead of php_value). This is available in php 4.0.4; I don't know about availability in earlier versions. I don't use this, though, so I'm just copying from the provided .ini file. -steve -- +--- "They've got a cherry pie there, that'll kill ya" ------------------+ | Steve Edberg University of California, Davis | | sbedberg@ucdavis.edu Computer Consultant | | http://aesric.ucdavis.edu/ http://pgfsun.ucdavis.edu/ | +-------------------------------------- FBI Special Agent Dale Cooper ---+