Comments on: PHP.INI settings: Disable exec, shell_exec, system, popen and Other Functions To Improve Security

By: anon

anon — Sat, 28 Jan 2012 12:35:01 +0000

So what’s the solution? To disable telnet?

By: kishan

kishan — Sat, 10 Dec 2011 05:42:51 +0000

this functions easily bypassed with cgi telnet perl script!

By: Daniel Alexandre

Daniel Alexandre — Sat, 14 May 2011 07:35:20 +0000

“ubuntu lover”: Either you want to disable those functions or not. If you want you have to change php.ini: overwrite disable_functions and set a new list or modify the existing one. I’m not sure you think it makes it useless. Only the server admin can do that and he will only disable the functions he wants, editing that list.
Also Eric says: “if you really need those functions, you can overwrite the configuration using ini_set function in your script to enable them for a particular site.” But again you can do that only on the server side.

By: ubuntu lover

ubuntu lover — Thu, 14 Apr 2011 10:47:38 +0000

if i create a custom php.ini file, it would overwrite disable_functions directive, so this is useless.
how can you overcome that???

By: mica

mica — Sun, 19 Sep 2010 20:44:31 +0000

readfile() and file_get_contents() functions are subject to the open_basedir restriction.
Obviously you should set the open_basedir php setting to your docroot, so the scripts won’t be able to read files above docroot in your file system!

By: Lekensteyn

Lekensteyn — Wed, 12 May 2010 10:55:14 +0000

show_source is an alias of highlight_file.
Why would you disable this function?
You can read the contents of a file with readfile() or file_get_contents :/

By: cliffsupport

cliffsupport — Mon, 26 Apr 2010 10:20:19 +0000

You should make sure the user cannot override the setting using .htaccess or custom php.ini

By: Mir

Mir — Tue, 30 Mar 2010 13:03:11 +0000

Why is “parse_ini_file” disabled?

By: Experts

Experts — Mon, 10 Nov 2008 12:21:24 +0000

Davide you are wrong “`” using shell_exec function so if we disable shell_exec then “`” will be disabled too

By: Eric Lin

Eric Lin — Sun, 03 Aug 2008 22:24:01 +0000

I guess if you really need those functions, you can overwrite the configuration using ini_set function in your script to enable them for a particular site.

By: Davide

Davide — Wed, 30 Jul 2008 14:59:31 +0000

This is not enought because you can always use “`” that will bypass these limitation.