[Phpmyadmin-devel] disabled functions for security

[robbat2 at orbis-terrarum.net]

On Mon, Mar 03, 2003 at 10:03:08AM -0500, Marc Delisle wrote:
> >>>>Problem is, in this case, function_exists('ini_get') is true
> >>>>even if ini_get() is disabled.
> >>>>
> >>>This is a problem, indeed. As far as I can say, we can only work around
> >>>this by adding a new directive to the config file, e.g.
> >>>$cfg['IniGetDisabled'] with default value FALSE. In this case we simply
> >>>replace ...
> >>>
> >>>function_exists('ini_get')
> >>>
> >>>... by ...
> >>>
> >>>(!$cfg['IniGetDisabled'] && function_exists('ini_get'))
> >>>
> >Just taking this generic for a sec, does somebody want to throw together
> >PMA_function_exists() that does the function_exists check + check if
> >it's disabled for a better result?
> I agree to take this generic, but just *how* can we check if it's disabled?
> Try it and look for an error?
Sounds like a good route to me.

I'm trying to hack together a testcase quickly.

-- 
Robin Hugh Johnson
E-Mail     : robbat2 at orbis-terrarum.net
Home Page  : http://www.orbis-terrarum.net/?l=people.robbat2
ICQ#       : 30269588 or 41961639
GnuPG FP   : 11AC BA4F 4778 E3F6 E4ED  F38E B27B 944E 3488 4E85
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: not available
URL: <http://lists.phpmyadmin.net/pipermail/developers/attachments/20030303/b2b608b4/attachment.sig>