I want to block ini_get('disable_functions') without blocking ini_get() in disable_functions section because when i block ini_get() in my server the roundcube dosen't load, how can i do that?
Asked
Active
Viewed 369 times
-3
-
Why do you want to block it...? – Nathan C Jul 09 '13 at 18:50
-
For security reason, In fact in the sheller it show the blocked functions, i want to hide this – alysa Jul 09 '13 at 18:53
-
1You want to hide this... from yourself?! What is really going on here? – Michael Hampton Jul 09 '13 at 19:02
-
You should consider trying to explain the whole situation if you need help. As asked this makes very little sense. – Falcon Momot Jul 09 '13 at 19:20
-
@alysa What security benefit do you anticipate this giving you? – ceejayoz Jul 09 '13 at 19:55
-
If an attacker knows the blocked function so try the open functions to approach his goal – alysa Jul 09 '13 at 19:58
-
@alysa An attacker is going to try all of them. It's trivial to automate. This won't make you the slightest bit more secure. – ceejayoz Jul 09 '13 at 20:04
-
ok you say true give me another negative score – alysa Jul 09 '13 at 20:08
1 Answers
3
As far as I know there is no way to block functions in PHP based on their arguments. Allowing a user to see what functions are disabled will have no impact on server security. They can't use the functions anyway, so what possible use could they make of this knowledge?
Update: If you really want to block functions in PHP based on arguments you would have to modify the source of PHP itself and recompile your PHP binaries, which you of course can do if you know some ANSI C.
tbjers
- 131
- 3
-
+1. There's no benefit to blocking this, especially as malicious users would try to use the blocked functions anyways and wind up with an error indicating that they're blocked. – ceejayoz Jul 09 '13 at 19:54
-
If an attacker knows the blocked function so try the open functions to approach his goal – alysa Jul 09 '13 at 19:58
-
@alysa An attacker is going to try all of them. It's trivial to automate. This won't make you the slightest bit more secure. – ceejayoz Jul 09 '13 at 20:04