Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83657
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain heroku.com designates 209.85.212.173 as permitted sender)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Message-ID: <E1B35E49-73D0-4A02-8E7D-A57F2AC5F125@heroku.com>
Date: Tue, 24 Feb 2015 12:59:22 +0100
To: PHP Internals <internals@lists.php.net>
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
Subject: Allow "tightening" of PHP_INI_SYSTEM directives in PHP_INI_PERDIR+ contexts?
From: dz@heroku.com (David Zuelke)

Hi,

Currently, some directives such as "expose_php" or "allow_url_fopen" can =
only be changed on the PHP_INI_SYSTEM level, which in some cases =
apparently even means through php.ini only.

Wouldn't it make sense to allow "tightening" of these values in, say, a =
PERDIR contexts? So "expose_php" can be disabled in an FPM config, but =
not enabled?

This would, I think, be useful for several directives that could then be =
set to a "safer" setting on a per-dir basis, such as:

- expose_php
- allow_url_fopen
- allow_url_includes (if set to "1" in system)
- disable_functions/classes (only additions to the list allowed)

Thoughts?

David