On Fri, Apr 11, 2014 at 10:55 PM, Reindl Harald <[email protected]>wrote: > > simply list "getenv" in "disable_functions", put <?php > $_SERVER['SERVER_ADDR']='';?> > in a file listed in "auto_prepend_file" and you are done, no need to touch > httpd for > that and in case of security by obscurity allow to remove the "Server" > header and hide > what webserver you are running would have more benefit >
This is basically what I'm doing now, though from a PHP C extension (didn't know about auto_prepend_file). Having a switch in Apache would allow a language-agnostic solution though.
