cvs: php4 / NEWS internal_functions_win32.c main.c php.ini-dist php.ini-optimized

zeev Mon May 29 10:22:36 2000 EDT Modified files: /php4 NEWS internal_functions_win32.c main.c php.ini-dist php.ini-optimized Log: - Added disable_functions php.ini support - Fixed Win32 build Index: php4/NEWS diff -u php4/NEWS:1.262 php4/NEWS:1.263 --- php4/NEWS:1.262 Sat May 27 09:38:49 2000 +++ php4/NEWS Mon May 29 10:22:35 2000 @@ -2,13 +2,15 @@ ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 2000, Version 4.0.1 +- Added disable_functions php.ini directive, to allow administrators to disable + certain functions for security reasons (Zeev) - Fixed sessions on Win32. When setting the directory depth parameter in save_path you need to now delimit it with a ';' instead of ':', e.g "5;/tmp" instead of "5:/tmp" (Andi) - Changed the Apache handler's return status to 'Declined' when a requested PHP file could not be found. Returning 'Not Found' caused problems in the ErrorDocument handler stage in that $REDIRECT_REDIRECT_ERROR_NOTES - was not getting set at all. Moving to 'Declined' shoudl fix this and I + was not getting set at all. Moving to 'Declined' should fix this and I can't see any other side effects. (Rasmus) - Fixed scanning decimal numbers in internationalized environments. They should always be in standard US format e.g. 23.3. (Andi, Zend Engine) Index: php4/internal_functions_win32.c diff -u php4/internal_functions_win32.c:1.29 php4/internal_functions_win32.c:1.30 --- php4/internal_functions_win32.c:1.29 Thu May 18 08:34:21 2000 +++ php4/internal_functions_win32.c Mon May 29 10:22:35 2000 @@ -18,7 +18,7 @@ */ -/* $Id: internal_functions_win32.c,v 1.29 2000/05/18 15:34:21 zeev Exp $ */ +/* $Id: internal_functions_win32.c,v 1.30 2000/05/29 17:22:35 zeev Exp $ */ #include "php.h" @@ -43,7 +43,7 @@ #include "ext/standard/php_dir.h" #include "ext/standard/php_filestat.h" #include "ext/standard/php_mail.h" -#include "ext/standard/php_syslog.h" +#include "ext/standard/php_ext_syslog.h" #include "ext/standard/php_standard.h" #include "ext/standard/php_lcg.h" #include "ext/standard/php_output.h" Index: php4/main.c diff -u php4/main.c:1.255 php4/main.c:1.256 --- php4/main.c:1.255 Sun May 28 10:19:49 2000 +++ php4/main.c Mon May 29 10:22:35 2000 @@ -19,7 +19,7 @@ */ -/* $Id: main.c,v 1.255 2000/05/28 17:19:49 andi Exp $ */ +/* $Id: main.c,v 1.256 2000/05/29 17:22:35 zeev Exp $ */ #include <stdio.h> @@ -148,6 +148,22 @@ } +static PHP_INI_MH(OnDisableFunctions) +{ + char *func; + char *new_value_dup = zend_strndup(new_value, new_value_length); /* This is an intentional leak, + * it's not a big deal as it's process-wide + */ + + func = strtok(new_value_dup, ", "); + while (func) { + zend_disable_function(func, strlen(func)); + func = strtok(NULL, ", "); + } + return SUCCESS; +} + + /* Need to convert to strings and make use of: * DEFAULT_SHORT_OPEN_TAG * PHP_SAFE_MODE @@ -232,6 +248,8 @@ PHP_INI_ENTRY("precision", "14", PHP_INI_ALL, OnSetPrecision) PHP_INI_ENTRY("sendmail_from", NULL, PHP_INI_ALL, NULL) PHP_INI_ENTRY("sendmail_path", DEFAULT_SENDMAIL_PATH, PHP_INI_SYSTEM, NULL) + + PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, OnDisableFunctions) PHP_INI_END() Index: php4/php.ini-dist diff -u php4/php.ini-dist:1.35 php4/php.ini-dist:1.36 --- php4/php.ini-dist:1.35 Wed May 10 02:31:53 2000 +++ php4/php.ini-dist Mon May 29 10:22:35 2000 @@ -105,6 +105,14 @@ ; even if safe_mode_allowed_env_vars is ; set to allow to change them. + +disable_functions = ; This directive allows you to disable certain + ; functions for security reasons. It receives + ; a comma separated list of function names. + ; This directive is *NOT* affected by whether + ; Safe Mode is turned on or off. + + ; Colors for Syntax Highlighting mode. Anything that's acceptable in <font color=???> would work. highlight.string = #DD0000 highlight.comment = #FF8000 Index: php4/php.ini-optimized diff -u php4/php.ini-optimized:1.4 php4/php.ini-optimized:1.5 --- php4/php.ini-optimized:1.4 Wed May 10 02:31:53 2000 +++ php4/php.ini-optimized Mon May 29 10:22:35 2000 @@ -93,6 +93,14 @@ ; even if safe_mode_allowed_env_vars is ; set to allow to change them. + +disable_functions = ; This directive allows you to disable certain + ; functions for security reasons. It receives + ; a comma separated list of function names. + ; This directive is *NOT* affected by whether + ; Safe Mode is turned on or off. + + ; Colors for Syntax Highlighting mode. Anything that's acceptable in <font color=???> would work. highlight.string = #DD0000 highlight.comment = #FF8000