Mantis - Quercus
Viewing Issue Advanced Details
4005 major always 04-20-10 00:31 12-10-12 14:34
hm2k  
nam  
normal  
closed  
fixed  
none    
none  
0004005: php.ini disable_functions does not work
phpinfo() reports that my php.ini is .../WEB-INF/php.ini

I know the php.ini is being used as other options are being set.

But the following does not work:

disable_functions = "dl,highlight_file"

As I am unable to disable these functions (and others), it poses a security risk and as such this bug is considered of high importance.

Notes
(0005236)
dicr   
05-11-11 15:24   
I think this can be implemented by native java security managers.
Please, search "quercus serurity manager".
http://www.caucho.com/resin-3.0/security/securitymanager.xtp [^]
(0006111)
nam   
12-10-12 14:34   
Fixed for 4.0.33.

disable_functions need to be set in php.ini.
(0006112)
nam   
12-10-12 14:34   
php/1004
php/1005
php/1006