php.ini (disable_functions) problem when (php2_release) enabled

T

trover

Verified User
Joined
Nov 4, 2015
Messages
76
Hi,

with below configuration, and same php.ini, some functions not disabled in First PHP (5.5 suphp) by "disable_functions"
but when i change domain setup {PHP Version Selector} to use Second PHP (5.6 fastcgi) everything is ok "same php.ini":


/usr/local/directadmin/custombuild/options.conf
Code: 
#PHP Settings
[COLOR=#FF0000]php1_release[/COLOR]=5.5
php1_mode=[COLOR=#ff0000]suphp[/COLOR]
[COLOR=#FF0000]php2_release[/COLOR]=5.6
php2_mode=[COLOR=#ff0000]fastcgi[/COLOR]

php_ini_type=production

webserver=[COLOR=#ff0000]nginx_apache[/COLOR]

and this 3 php.ini's have same disable_functions list:
/usr/local/lib/php.ini
/usr/local/php55/lib/php.ini
/usr/local/php56/lib/php.ini

-----------

so, when i open domain.com/status/index.php there is different output on any of (php5.5) and (php5.6) !

for php5.5 is not ok: 0.05 3 Days 12:50:41 (mean can read "server load" and "server uptime" !)
for php5.6 is ok: (mean its right and can't read "load and uptime" as i disabled function in php.ini)




index.php codes:
Code: 
<?php

error_reporting(0);

$action = (isset($_GET['action'])) ? $_GET['action'] : '';

if ($action=="phpinfo") {
    #phpinfo();

} else {

    $load = file_get_contents("/proc/loadavg");
    $load = explode(' ',$load);
    $load = $load[0];
    if (!$load && function_exists('exec')) {
        $reguptime=trim(exec("uptime"));
        if ($reguptime) if (preg_match("/, *(\d) (users?), .*: (.*), (.*), (.*)/",$reguptime,$uptime)) $load = $uptime[3];
    }

    $uptime_text = file_get_contents("/proc/uptime");
    $uptime = substr($uptime_text,0,strpos($uptime_text," "));
    if (!$uptime && function_exists('shell_exec')) $uptime = shell_exec("cut -d. -f1 /proc/uptime");
    $days = floor($uptime/60/60/24);
    $hours = str_pad($uptime/60/60%24,2,"0",STR_PAD_LEFT);
    $mins = str_pad($uptime/60%60,2,"0",STR_PAD_LEFT);
    $secs = str_pad($uptime%60,2,"0",STR_PAD_LEFT);

    $phpver = phpversion();
    $mysqlver = (function_exists("mysql_get_client_info")) ? mysql_get_client_info() : '-';
    $zendver = (function_exists("zend_version")) ? zend_version() : '-';

    echo "<load>$load</load>\n";
    echo "<uptime>$days Days $hours:$mins:$secs</uptime>\n";

}

also i have "exec" and "shell_exec" in disable_functions

is this a bug? or?

Thanks
 
Just run "./build secure_php" to disable functions in all currently enabled versions of PHP. If you change any PHP release settings in the options.conf file, you should run "./build secure_php" again to secure your new version of PHP.
 
smtalk said:
Just run "./build secure_php" to disable functions in all currently enabled versions of PHP. If you change any PHP release settings in the options.conf file, you should run "./build secure_php" again to secure your new version of PHP.
Click to expand...

thanks for reply,
but as i said in first post, i add full and same list of functions for "disable_functions" in all 3 php.ini's.
/usr/local/lib/php.ini
/usr/local/php55/lib/php.ini
/usr/local/php56/lib/php.ini


just for sure i run secure php command again ... but it's not solve the problem!
[root@server custombuild]# ./build secure_php
PHP has been secured.
Stopping httpd: [ OK ]
Starting httpd:

Code: 
disable_functions = exec,system,passthru,shell_exec,escapeshellarg,escapeshellcmd,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname
 
It's nothing related to disable_functions, you used file_get_contents() :) If you get it disabled, the script won't work (as well as many other scripts on the system). Your problem is open_basedir related. suPHP doesn't have any open_basedir protection set up by default (and it probably won't have in the future, because it's already EOL), please check http://help.directadmin.com/item.php?id=183 for a how-to if you need suPHP and open_basedir protection for it.
 
yes your right,

what is your suggestion for [php1_mode=] and [php2_mode=] ? (i mean for fast and secure)
 
PHP-FPM, fastcgi or lsphp (on CloudLinux system) are all pretty stable, fast and secure.
 
so, for nginx_apache can i use this configuration ?

#PHP Settings
php1_release=5.5
php1_mode=php-fpm
php2_release=5.6
php2_mode=fastcgi

--- and or:

#PHP Settings
php1_release=5.5
php1_mode=fastcgi
php2_release=5.6
php2_mode=php-fpm


and to changes i have to run ./build all or can done by ./build php n ?
 
Last edited:
You must log in or register to reply here.
Back
Top