Home / server / Questions / 403600
Accepted
Gaia
Asked: 2012-06-30 14:53:40 +0800 CST

How to disallow use of disable_functions in?

  • 772

I'm obviously not the first one to have this problem, but I cannot not find an answer to this situation.

I want to lock down PHP a bit, more specifically the use of disable_functions. The environment is CentOS 6.2/PHP 5.3.3 fcgid/Apache 2.2.15:

  1. Whats the proper apache config (AllowOverride, etc) to disable any PHP setting to be changed via .htaccess? All other overrides are ok (current setting is AllowOverride All)

  2. Whats the proper config to forbid effective use of disable_functions in all but the master php.ini (as in forbid use of disable_functions in /home/myvhost/etc/php5/php.ini or any directory within in that vhost public_html. another way to say this: the only effective disable_functions comes from the master php.ini)?

  3. If #2 is not possible, at least whats the proper config to disallow a vhost owner to effectively use any php.ini but the vhost main one (/home/myvhost/etc/php5/php.ini)?

Thanks

php apache-2.2 php.ini php5 shared-hosting

1 Answers

  1. Best Answer

    1. .htaccess only overrides PHP when mod_php is used, and doing so requires Options override permissions. All other cases, you cannot directly override ini options from the htaccess file, but with FileInfo you may be able to override the default FCGI handler to point to an alternate fcgi handler with a flag to tell php to use an alternate .ini file.

    2. I do not believe this is possible.

    3. Don't allow vhosts to override FileInfo.

    FileInfo allows htaccess files to override AddHandler, SetHandler and Action for CGIs as well as FcgidWrapper for mod_fcgid.

    • 3