4 ms·
Yes, you can disable any arbitrary internal function in PHP using disable_functions[1] directive in php.ini [1] http://php.net/manual/en/ini.core.php#ini.disab
by RobAley 14y ago
Yes, you can disable any arbitrary internal function in PHP using disable_functions[1] directive in php.ini
[1] http://php.net/manual/en/ini.core.php#ini.disable-functions http://php.net/manual/en/ini.core.php#ini.disable-functions
Edit: Also, as noted below, this wouldn't prevent this or many other similar hacks as you need write access to the PHP script to put the eval in in the first place, so you could just write other code in there directly (and pull in extra scripts to execute by writing to disk etc. if necessary). Eval is typically dangerous, in its own right, when it is used by the legitimate developer who then allows unchecked code to be passed to it.
- degenerate 14y agoAnd how to use it: http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpini-disable-functions/ http://www.cyberciti.biz/faq/linux-unix-apache-lighttpd-phpi... Just remove anything you use. I use cURL, so I took it out.
- infinity 14y agoThe problem with disable_functions is that eval is not an internal function, but a language construct. From the manual: Only internal functions can be disabled using this directive. It is possible to generate something like a list of all available internal functions, eval is missing here: $arr = get_defined_functions(); var_dump($arr['internal']); The Suhosin extension will let you block eval, if it is available: http://www.hardened-php.net/suhosin/configuration.html#suhosin.executor.disable_eval http://www.hardened-php.net/suhosin/configuration.html#suhos...
- RobAley 14y agoApologies, you are correct, I was thinking of exec.