From: iwonderiftheyllpostthistoapublicnewsgroup at r1ch dot net Operating system: Linux PHP version: 4.3.6 PHP Bug Type: PHP options/info functions Bug description: Disabling allow_url_fopen via httpd.conf has no effect
Description: ------------ To improve security against poor coding I wish to disable allow_url_fopen by default and allow users who have a legitimate need for it to enable it themselves via use of .htaccess or ini_set(). Given that allow_url_fopen is listed as PHP_INI_ALL in the docs I thought this would be relatively easy, however I am unable to make it work: Having allow_url_fopen off in php.ini disables it completely - the user cannot activate it via .htaccess or ini_set(). So I tried to use php_flag allow_url_fopen off in my httpd.conf to turn it off by default. However this has no effect at all and users can happily use URL-fopen functions without turning it on. Using php_admin_flag instead of php_flag disables it entirely as if set via php.ini. There appears to be no middle-ground here that lets the user control use of this function instead of everybody or nobody having access. Reproduce code: --------------- httpd.conf ---------- php_flag allow_url_fopen off test.php -------- <?php echo "<p>here is file:</p>"; readfile("http://www.r1ch.net/ohno"); ini_set ("allow_url_fopen", "1"); echo "<p>here is more file:</p>"; readfile("http://www.r1ch.net/ohno"); ?> Expected result: ---------------- here is file: Warning: readfile(): URL file-access is disabled in the server configuration in /.../test.php on line 2 here is more file: ohno Actual result: -------------- here is file: ohno here is more file: ohno -- Edit bug report at http://bugs.php.net/?id=28497&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=28497&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=28497&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=28497&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=28497&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=28497&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=28497&r=needscript Try newer version: http://bugs.php.net/fix.php?id=28497&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=28497&r=support Expected behavior: http://bugs.php.net/fix.php?id=28497&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=28497&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=28497&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=28497&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=28497&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=28497&r=dst IIS Stability: http://bugs.php.net/fix.php?id=28497&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=28497&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=28497&r=float