4 ms·
Disabling parse_ini_file looks like a mistake too ;) (It's just a ini file parser; it has nothing to do with PHP settings.)
by fooyc 15y ago
Disabling parse_ini_file looks like a mistake too ;)
(It's just a ini file parser; it has nothing to do with PHP settings.)
- jamescun 15y agoI typically disabled it because (historically, not 100% sure now) even with restrictions in place, you can still read PHP.ini and (not now mind) you could also write to the INI config with the ini functions.
- duskwuff 15y ago> You can still read PHP.ini You can always detect the contents of php.ini using functions like ini_get. Disabling those isn't recommended, as a lot of applications use them legitimately to read things like memory_limit or safe_mode. > You could also write to the INI config with the ini functions. That sounds really unlikely, unless you had php.ini owned by your Apache user or you were running PHP as root. Either one of those possibilities would have left you open to much worse problems. Perhaps you're thinking of ini_set? That only affects the current request; it doesn't have any long-term effects, nor does it write to config files.
- Joakal 15y agoparse_ini_file is highly useful if you want to avoid tumblr's php file sensitive exposure problem of includes.
- damncabbage 15y agoCould you explain this a little more, please?
- Joakal 15y agoI'm referring to Tumblr's typo that did not render the PHP script and due to an include, it was displayed as plain text: http://news.ycombinator.com/item?id=2343330 http://news.ycombinator.com/item?id=2343330 You can see some discussions within on how to avoid it.