exec() and shell_exec() enabled for spamexperts plugin, security issue ?

[wouta]

Dear,

I try to use the spamexpert plugin. Now i saw the follow error when i create or delete a domain.

PHP Notice: Undefined variable: output in /usr/local/directadmin/plugins/latest/lib/Configuration.php on line 56
PHP Notice: Undefined variable: return in /usr/local/directadmin/plugins/latest/lib/Configuration.php on line 56
PHP Warning: exec() has been disabled for security reasons in /usr/local/directadmin/plugins/latest/lib/Configuration.php on line 56
PHP Notice: Undefined variable: output in /usr/local/directadmin/plugins/latest/lib/Configuration.php on line 58
PHP Warning: implode(): Invalid arguments passed in /usr/local/directadmin/plugins/latest/lib/Configuration.php on line 58

I have the enabling exec and shell_exec done via /usr/local/directadmin/custombuild/custom/php_disable_functions so now every body can use exec, shell_exec function i geuss. However my user are all using php selector form cloudlinux.

Now i have enabled exec and shell_exec but i doubt if this realy the best solution for this isseu and my feeling says this is a potential high risk solution. Are there better ways to do this ?

 

[scriptkitty]

Hi!

You might consider submitting a feature request to them to ship their own php.ini with the plugin:

https://docs.directadmin.com/direct...plugin.html#how-to-call-php-with-your-php-ini

Or, maybe try using this method for "/usr/local/directadmin/plugins/" path, but you'd need to customize the php.ini files for Cloudlinux's PHP selector:

https://help.directadmin.com/item.php?id=622

Edit: I have not tested the 2nd method for plugins. Please let us know how you proceed and the outcome.

 

[wouta]

Hi,


I have add a other solution for now. Maybe it will help others with this issue.

It turns out that a php file is being called from a bash script. What I'm doing now as a workaround is when the script call the php script i add a disabled_function.
change in the plugin dir scripts/hooks/domain_create_post

php /usr/local/directadmin/plugins/latest/hooks/scripts/domain_create_post.php $domain

to

php -d disable_functions="" /usr/local/directadmin/plugins/latest/hooks/scripts/domain_create_post.php $domain

I have not yet tested whether this is also necessary for other scripts.