//Dangerous PHP Functions Enabled

[MAHMUT ORHAN]

Hi,

I almost set up my website with invision community, but I didn't check this one because it was removing the signup buttons and etc if I disable this functions. 

 

After I talk about this with my host provider, they sent me this php version .ini files and I added this disable_functions to top, to make sure. But this functions made my invision community to lose register login areas and few other things like rich texts etc.

my invision community site is on public.html > /forum/ folder the main publichtml is wordpress based I installed invision on the forum folder.

So fix this issue; should I do this job on /forum/ folder or public html folder the main folder.

And what is the correct way to do it.
 

Should I just remove the other functions and just type the disable_functions = ?

Please thanks for any help.

disable_functions = "show_source, system, shell_exec, exec"
disable_functions ="exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec"
;---apcu---
extension=apcu.so

;---bcmath---
extension=bcmath.so

;---dom---
extension=dom.so

;---fileinfo---
extension=fileinfo.so

;---gd---
extension=gd.so

;---imagick---
extension=imagick.so

;---imap---
extension=imap.so

;---intl---
extension=intl.so

;---mbstring---
extension=mbstring.so

;---mysqlnd---
extension=mysqlnd.so

;---nd_mysqli---
extension=nd_mysqli.so

;---opcache---
zend_extension=/opt/alt/php80/usr/lib64/php/modules/opcache.so

;---pdo---
extension=pdo.so

;---pdo_mysql---
extension=pdo_mysql.so

;---pdo_pgsql---
extension=pdo_pgsql.so

;---pdo_sqlite---
extension=pdo_sqlite.so

;---pgsql---
extension=pgsql.so

;---phar---
extension=phar.so

;---posix---
extension=posix.so

;---soap---
extension=soap.so

;---sockets---
extension=sockets.so

;---sqlite3---
extension=sqlite3.so

;---tidy---
extension=tidy.so

;---xmlreader---
extension=xmlreader.so

;---xmlwriter---
extension=xmlwriter.so

;---xsl---
extension=xsl.so

;---zip---
extension=zip.so

 

Edited June 12, 2022 by MAHMUT ORHAN

[Randy Calvert]

Typically you should not have two lines with the same function called. Just add the additional parameters to the first line all comma separated. 

It does not need the rest of the module lines. I would delete all of that and literally only have the one line with disabled functions. 

It should go typically inside your forums folder or wherever you want it to apply. 

Edited June 12, 2022 by Randy Calvert

[Jim M]

Going to move this to our advanced server assistance forum as this is really outside our scope of support when it comes to editing PHP configuration files, I'm afraid.

[MAHMUT ORHAN]

I added the php.ini to forum folder that where invision community but I believe it doesnt work from that side

I must be on public html I believe.?

[Davyc]

8 minutes ago, MAHMUT ORHAN said:

I added the php.ini to forum folder that where invision community but I believe it doesnt work from that side

You should ask your ISP if the php.ini file is recursive when placed in the root.  If not, then you will have to add the php.ini file to every single folder - and there's a lot of folders.  Some just add it to a specific folder and the warning message goes away, but that's a sticking plaster on a gaping wound.  Find out first if there is a way to make a single php.ini file recursive from your ISP.

[Randy Calvert]

You can set up one or multiple custom php.ini files to define how your web site functions.

For example, you might have a custom file in your /home/username/public_html directory for your web site's main pages, and a separate custom file in your /home/username/public_html/images directory for your web site's image files.

[Stuart Silvester]

The disable_function directive can only be set in the servers master php.ini, it cannot be changed in user/custom configuration files. It would be quite pointless from a security perspective if you could just disable it.

Disabling it for your own user only is also not effective, the problem with these functions being available on the server is that other users on the server may be able to use them to damage your community or breach your data. If this is a shared host, it would suggest that their server security may already be quite lax.

[Pescao6]

My host just disabled them for me on cPanel and the warning went away. 😬