Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99210
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.46 as permitted sender)
MIME-Version: 1.0
Date: Sat, 27 May 2017 21:20:26 -0600
Message-ID: <CAK0ZC5XpqQdNGBbPkWJDgom49H7RTGmmmJnwR+8HPTtEO8z-dw@mail.gmail.com>
To: internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Improve (disable|enable)_functions #65386
From: own3mall@gmail.com (OwN-3m-All)

Is there any update on this request?

I can see quite a few security concerns that could be mitigated if we
could enable and disable certain functions at the virtual host level.

nginx paired with php-fpm appears to already work this way.  For
consistency purposes, shouldn't this be implemented in the apache php
module as well?  It should work the way nginx does.

For example, in nginx, I can use the following (below is just a sample example):

server {
    listen   80;
    server_name  example.com;

    root {homedir}/httpdocs;

    index  index.html index.htm index.php;

    location ~ \.php$ {
        root {homedir}/httpdocs;
        include fastcgi_params;
        try_files $uri = 404;
        fastcgi_pass   127.0.0.1:9000;
        fastcgi_index  index.php;
        fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        fastcgi_param  PHP_ADMIN_VALUE
"disable_functions=exec,passthru,shell_exec,system,proc_open,popen";
        fastcgi_read_timeout 300;
        limit_req zone=one burst=5;
    }
}

The functions specified in the domain specific configuration are
properly disabled in nginx.  But in Apache, this does NOT work:

<VirtualHost *>
    ServerName   {domainname}

    DocumentRoot {homedir}/httpdocs
    DirectoryIndex index.htm index.html index.php

    php_admin_value disable_functions
"exec,passthru,shell_exec,system,proc_open,popen"

</VirtualHost>

Considering we can set so many other admin values in the virtual host
configuration, I really don't see why this wouldn't be possible.  It
would be useful and improve security.  I'm hoping someone can
implement a solution for this at some point because until then, I plan
to use nginx since I can control function usage.