php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Request #52325 multiple php.ini with mod_php5 allusive or impossible
Submitted: 2010-07-13 10:22 UTC Modified: 2021-08-02 16:14 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: admin at digibase dot ca Assigned: cmb (profile)
Status: Wont fix Package: PHP options/info functions
PHP Version: Irrelevant OS: Linux
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2010-07-13 10:22 UTC] admin at digibase dot ca
Description:
------------
Greetings,

I have noticed that under apache, setting php.ini-only directives (such as disable_functions - which is not accepted in httpd.conf) per virtual host can only be done by installing php with something like suPHP. This is not a desirable configuration in most cases when php is already installed as mod_php4 or mod_php5.

Furthermore, for loading php.ini files, PHPRC environment variable seems to be ignored, as well, PHPINIDir only is accepted once per apache configuration, even in completely different vhost blocks.

I run a shared hosting infastructure for special project sites, Now, I would like to have a default, restricted PHP configuration, then under certain virtual host blocks (for example, for users I approve) set up "less restricted" php.ini files for those accounts.

Also, there are several internally run sites that need a very loose setup but I would not want regular users having that setup for themselves.

The issue at the moment is for many options, PHP does not accept more than one setup per server (oncemore, in the case of disable_functions).

Test script:
---------------
<?
system('ls');
?>

Expected result:
----------------
On one "restricted" vhost with options set via php.ini:
The script should return that the system() function is disabled.

On a "less restricted" vhost with options set via php.ini:
The script should execute the system() call. 

Actual result:
--------------
Either:

On one "restricted" vhost with options set via php.ini:
The script returns that the system() function is disabled.

On a "less restricted" vhost with options set via php.ini:
The script returns that the system() function is disabled.

Or:

On one "restricted" vhost with options set via php.ini:
The script executes the system() call. 

On a "less restricted" vhost with options set via php.ini:
The script executes the system() call. 


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2010-07-13 10:31 UTC] admin at digibase dot ca
Just as clarification:

in my test cases,
On one "restricted" vhost with options set via php.ini:
On a "less restricted" vhost with options set via php.ini:

these lines should be regarded as:

On one "restricted" vhost with options set via /etc/php/profiles/default/php.ini:
On a "less restricted" vhost with options set via /etc/php/profiles/approved/php.ini:
 [2013-08-03 15:55 UTC] ben dot rubson at gmail dot com
See summary bug #65386
 [2021-08-02 16:14 UTC] cmb@php.net
-Status: Open +Status: Wont fix -Assigned To: +Assigned To: cmb
 [2021-08-02 16:14 UTC] cmb@php.net
Since this feature request got no traction for more than ten
years, and given that using a single Apache instance for multiple
users isn't exactly best practice, I'm closing this ticket as
WONTFIX.  If anybody still feels this would be a good feature
addition, please pursue the RFC process[1].

[1] <https://wiki.php.net/rfc/howto>
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Tue Apr 23 08:01:30 2024 UTC