Possible to make exception to PHP's disable_function list for specific user?

[peps03]

Hi,

I'm trying to figure out if it is possible to make an exception to PHP's disable_function list for a specific user?

Enabled via CB:

The list is added to php.ini:

But I like to ALLOW some of these functions for a specific user.

How do I do that?

Thanks!

 

[factor]

CustomBuild secure_php | Directadmin Docs

DirectAdmin Knowledge Base

docs.directadmin.com

The DA secure php is global but can be customized as above.

You can use a user PHP.ini file as well I think. I dont do that thought all my shared customers get same. If they need custom stuff I sell them a vps

 

[Richard G]

Just to be sure, this is only possible if you don't have them enabled in your global php.ini.
You can't undo a globally set disabled function on per user base.

 

[factor]

You can't undo a globally set disabled function on per user base.

Right I was just about to add that.. in rereading it..

 

[peps03]

You can't undo a globally set disabled function on per user base.

Hmmm shit. That is what I was hoping...

 

[factor]

No it would be the other way open it up and set every other user on the entire box to more strict.

Lot of work for one person.

 

[peps03]

And what if I put this user on PHP7.3 and only open this version up?

Could I block other users from switching down to 7.3?

 

[Zhenyapan]

@bdacus01 @peps03 @Richard G
there are easier way: "custom httpd" -> "php-fpm" -> "php-fpm Global custom2" or "php-fpm VER_number"
and there add line like:
php_admin_value[disable_functions] = mail, fileinfo
wait 1 min till php-fpm restart via cron and check phpinfo.

 

[Richard G]

No it would be the other way open it up and set every other user on the entire box to more strict.

Correct, which would also be less safe because every user would be able to make it less again, unless after changing you would disable that option again, so indeed a whole lot of work.

there are easier way:

Which is also for all users, not for 1 user, right?

Could I block other users from switching down to 7.3?

Maybe via the exclude command which would take care that nobody could switch down to 7.3. Never tried this before.

Exactly which disabled_functions do you want to exclude for that user?

 

[Zhenyapan]

for one, it's applied for it's own php-pool, it's benefit of php-fpm

 

[Richard G]

I hope that will work, because what I have understood is that disabled_functions was the only thing which could not setup on a per user base in any way. So if it would work like that, then this would help several others.

 

[Zhenyapan]

just checked to be sure - yes, it can be set for each user and each php version individually.

 

[factor]

it's own php-pool,

I had forgotten this..

 

[peps03]

Ah I see. So if Globally all 'unsafe' functions are disabled, the functions in the line below will 'overrule' the global disable all 'unsafe' functions and only disable the ones listed for this user, correct?

php_admin_value[disable_functions] = mail, fileinfo

 

[Erulezz]

Ah I see. So if Globally all 'unsafe' functions are disabled, the functions in the line below will 'overrule' the global disable all 'unsafe' functions and only disable the ones listed for this user, correct?

php_admin_value[disable_functions] = mail, fileinfo

Yes ? that’s what i have been doing for years.

 

[Erulezz]

Whoops i didn’t read it correctly i think. As mentioned before, you can’t overwrite functions that are globally disabled in your php.ini.

I don’t use the disable_functions option in php.ini, instead i disable functions per user as mentioned in #8

 

[peps03]

Hmm still getting this error:

While global exception is added:

 

[Ohm J]

nope..., You can't rewrite global disable_functions list

so you need to remove that inside php.ini then make it functionly with php-fpm

it should be like this

/usr/local/directadmin/data/templates/custom/php-fpm.conf.custom2

|*if USER="some_user"|
php_admin_value[disable_functions] = ""
|*else|
php_admin_value[disable_functions] = {LIST FROM php.ini that you remove in first step}
|*endif|

and rebuild template
cd /usr/local/directadmin/custombuild
./build rewrite_confs

###EDIT###
correct variable "USER"

 

[Zhenyapan]

@peps03 phpinfo shows you that disable functions clean on this domain?

 

[factor]

the disable_functions option in php.ini,

So you blank out the main disable_functions in php.ini?

Does that way protect the CLI of php? if you do it like #8?

@Zhenyapan @Erulezz @jamgames2

Maybe you all put a how to together on this. I have never done it this way so it might be interesting to have this documented.