Page MenuHomePhabricator

Allow disabling of phpinfo within php.ini
Closed, WontfixPublic

Description

Currently the pre-flight checks will throw a wobbly if the disable_functions configuration parameter is defined within php.ini.

Some security policies mandate that phpinfo specifically is disabled.

Since phabricator doesn't need phpinfo to run, I suggest allowing this as an exception?

A small modification to /phabricator/src/applications/config/check/PhabricatorPHPPreflightSetupCheck.php sorts this (though aware its in the middle of the Debian commentary!).

+ // # We are required to disable phpinfo by Security Audit - AF 29/03/2017
+ if ($function === 'phpinfo') {
+ unset($functions[$k]);
+

Event Timeline

chad claimed this task.

fast response, any words as to why this wont be fixed?

Hmmm, will have another go and delete bits and guess what i did wrong was suggesting a solution..