The default is to allow all files to be
opened.
disable_functions string
This directive allows you to disable certain functions for
security reasons. It takes on a comma-delimited list of
function names. disable_functions is not affected by Safe
Mode.
This directive must be set in php.ini For example, you
cannot set this in httpd.conf.
disable_classes string
This directive allows you to disable certain classes for
security reasons. It takes on a comma-delimited list of
class names. disable_classes is not affected by Safe Mode.
This directive must be set in php.ini For example, you
cannot set this in httpd.conf.
Availability note: This directive became available in PHP
4.3.2
See also: register_globals, display_errors, and log_errors
When safe_mode is on, PHP checks to see if the owner of
the current script matches the owner of the file to be operated
on by a file function. For example: -rw-rw-r-- 1 rasmus
rasmus 33 Jul 1 19:20 script.php
-rw-r--r-- 1 root root 1116 May 26 18:01 /etc/passwd
Running this script.php <?php
readfile('/etc/passwd');
?>
results in this error when safe mode is enabled: Warning:
SAFE MODE Restriction in effect. The script whose uid is
500 is not
allowed to access /etc/passwd owned by uid 0 in /docroot/script.php
on line 2
However, there may be environments where a strict UID check
is not appropriate and a relaxed GID check is sufficient.
This is supported by means of the safe_mode_gid switch.
Setting it to On performs the relaxed GID checking, setting
it to Off (the default) performs UID checking.
If instead of safe_mode, you set an open_basedir directory
then all file operations will be limited to files under
the specified directory For example (Apache httpd.conf example):
<Directory /docroot>
php_admin_value open_basedir /docroot
</Directory>
If you run the same script.php with this open_basedir setting
then this is the result: Warning: open_basedir restriction
in effect. File is in wrong directory in
/docroot/script.php on line 2
You can also disable individual functions. Note that the
disable_functions directive can not be used outside of the
php.ini file which means that you cannot disable functions
on a per-virtualhost or per-directory basis in your httpd.conf
file. If we add this to our php.ini file: disable_functions
readfile,system
Then we get this output: Warning: readfile() has been disabled
for security reasons in
/docroot/script.php on line 2
