- Added disable_functions php.ini support

- Fixed Win32 build

diff --git a/NEWS b/NEWS
index 0fb582bc6b193ebd659d8ff2b2aa2bda8302f71a..3a17a7b78a9d4d820618afd45d99041522b54ca6 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,13 +2,15 @@ PHP 4.0                                                                    NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 
 ?? ??? 2000, Version 4.0.1
+- Added disable_functions php.ini directive, to allow administrators to disable
+  certain functions for security reasons (Zeev)
 - Fixed sessions on Win32. When setting the directory depth parameter in
   save_path you need to now delimit it with a ';' instead of ':', e.g
   "5;/tmp" instead of "5:/tmp" (Andi)
 - Changed the Apache handler's return status to 'Declined' when a requested
   PHP file could not be found.  Returning 'Not Found' caused problems
   in the ErrorDocument handler stage in that $REDIRECT_REDIRECT_ERROR_NOTES
-  was not getting set at all.  Moving to 'Declined' shoudl fix this and I
+  was not getting set at all.  Moving to 'Declined' should fix this and I
   can't see any other side effects.  (Rasmus)
 - Fixed scanning decimal numbers in internationalized environments. They should
   always be in standard US format e.g. 23.3. (Andi, Zend Engine)

diff --git a/main/internal_functions_win32.c b/main/internal_functions_win32.c
index bddc81805de9f3f85a4a0f5cc7211047701a994b..f6d1bbc3ee5535690c1c0c9c5bd42ea91324e89c 100644 (file)
--- a/main/internal_functions_win32.c
+++ b/main/internal_functions_win32.c
@@ -43,7 +43,7 @@
 #include "ext/standard/php_dir.h"
 #include "ext/standard/php_filestat.h"
 #include "ext/standard/php_mail.h"
-#include "ext/standard/php_syslog.h"
+#include "ext/standard/php_ext_syslog.h"
 #include "ext/standard/php_standard.h"
 #include "ext/standard/php_lcg.h"
 #include "ext/standard/php_output.h"

diff --git a/main/main.c b/main/main.c
index 76c8d83de2cf0fe47f0fffb6a89702157a623276..fdeeb5747a287324ccf9c26e03cd426823ff93e2 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -148,6 +148,22 @@ static PHP_INI_MH(OnUpdateErrorReporting)
 }
 
 
+static PHP_INI_MH(OnDisableFunctions)
+{
+       char *func;
+       char *new_value_dup = zend_strndup(new_value, new_value_length);        /* This is an intentional leak,
+                                                                                                                                                * it's not a big deal as it's process-wide
+                                                                                                                                                */
+
+       func = strtok(new_value_dup, ", ");
+       while (func) {
+               zend_disable_function(func, strlen(func));
+               func = strtok(NULL, ", ");
+       }
+       return SUCCESS;
+}
+
+
 /* Need to convert to strings and make use of:
  * DEFAULT_SHORT_OPEN_TAG
  * PHP_SAFE_MODE
@@ -232,6 +248,8 @@ PHP_INI_BEGIN()
        PHP_INI_ENTRY("precision",                                      "14",           PHP_INI_ALL,            OnSetPrecision)
        PHP_INI_ENTRY("sendmail_from",                          NULL,           PHP_INI_ALL,            NULL)
        PHP_INI_ENTRY("sendmail_path",  DEFAULT_SENDMAIL_PATH,  PHP_INI_SYSTEM,         NULL)
+
+       PHP_INI_ENTRY("disable_functions",                      "",                     PHP_INI_SYSTEM,         OnDisableFunctions)
 PHP_INI_END()
 
 

diff --git a/php.ini-dist b/php.ini-dist
index a86970dcbde7a321991005c06076041e7632a16c..0a76188079f1efa19c19c4894c45d33f3f61a8db 100644 (file)
--- a/php.ini-dist
+++ b/php.ini-dist
@@ -105,6 +105,14 @@ safe_mode_protected_env_vars = LD_LIBRARY_PATH             ; This directive contains a comm
                                                                                                        ; even if safe_mode_allowed_env_vars is
                                                                                                        ; set to allow to change them.
 
+
+disable_functions      =                                                               ; This directive allows you to disable certain
+                                                                                                       ; functions for security reasons.  It receives
+                                                                                                       ; a comma separated list of function names.
+                                                                                                       ; This directive is *NOT* affected by whether
+                                                                                                       ; Safe Mode is turned on or off.
+                                                                                                       
+
 ; Colors for Syntax Highlighting mode.  Anything that's acceptable in <font color=???> would work.
 highlight.string       =       #DD0000
 highlight.comment      =       #FF8000

diff --git a/php.ini-optimized b/php.ini-optimized
index 2f2f2152aa0ced3e52a34506ba3bbee42aac0fbc..3e8b72165668c3d2a06a1b9d2607a71f7d1291f6 100644 (file)
--- a/php.ini-optimized
+++ b/php.ini-optimized
@@ -93,6 +93,14 @@ safe_mode_protected_env_vars = LD_LIBRARY_PATH               ; This directive contains a comm
                                                                                                        ; even if safe_mode_allowed_env_vars is
                                                                                                        ; set to allow to change them.
 
+
+disable_functions      =                                                               ; This directive allows you to disable certain
+                                                                                                       ; functions for security reasons.  It receives
+                                                                                                       ; a comma separated list of function names.
+                                                                                                       ; This directive is *NOT* affected by whether
+                                                                                                       ; Safe Mode is turned on or off.
+
+
 ; Colors for Syntax Highlighting mode.  Anything that's acceptable in <font color=???> would work.
 highlight.string       =       #DD0000
 highlight.comment      =       #FF8000

diff --git a/php.ini-recommended b/php.ini-recommended
index 2f2f2152aa0ced3e52a34506ba3bbee42aac0fbc..3e8b72165668c3d2a06a1b9d2607a71f7d1291f6 100644 (file)
--- a/php.ini-recommended
+++ b/php.ini-recommended
@@ -93,6 +93,14 @@ safe_mode_protected_env_vars = LD_LIBRARY_PATH               ; This directive contains a comm
                                                                                                        ; even if safe_mode_allowed_env_vars is
                                                                                                        ; set to allow to change them.
 
+
+disable_functions      =                                                               ; This directive allows you to disable certain
+                                                                                                       ; functions for security reasons.  It receives
+                                                                                                       ; a comma separated list of function names.
+                                                                                                       ; This directive is *NOT* affected by whether
+                                                                                                       ; Safe Mode is turned on or off.
+
+
 ; Colors for Syntax Highlighting mode.  Anything that's acceptable in <font color=???> would work.
 highlight.string       =       #DD0000
 highlight.comment      =       #FF8000