Everything

php

retrieving information about state of a function

php.internals

Dennis Sterzenbach

22 years ago

Hi,

I recognized there isn't any built-in function which
tells the disabled/enabled state of some function.
I think of something like:

if (function_enabled("shell_exec")) {
$info = shell_exec("dig myname.com");
}

telling if shell_exec is disabled by php.ini setting
or not.

I already implemented a check which uses an ini_get() to
retrieve the list of disabled functions, but I think it
would be more smooth having a function provided by PHP
for that purpose, because there are functions for all the
other kinds of checks: included files, declared classes,
defined constants/variables, defined functions, etc.

Why not having a function which gives information about
disabled/enabled state of a function?

I think if the function was provided by PHP makes it
faster. -Think of having to explode() and in_array() check
for the function. The PHP engine could simply have the
list of disabled functions to hand a true/false directly
from C code. Which seems to be the more consequent and
ideal solution.

--
Dennis Sterzenbach
www.darknoise.de

Derick Rethans

22 years ago

On Wed, 1 Oct 2003, Dennis Sterzenbach wrote:

> Hi,
>
> I recognized there isn't any built-in function which
> tells the disabled/enabled state of some function.
> I think of something like:
>
> if (function_enabled("shell_exec")) {
>    $info = shell_exec("dig myname.com");
> }
>
> telling if shell_exec is disabled by php.ini setting
> or not.

You can either use function_exists() to check if a function is
available, or use "ini_get('disabled_functions')".

Derick

--
"Interpreting what the GPL actually means is a job best left to those
that read the future by examining animal entrails."
-------------------------------------------------------------------------
Derick Rethans                                 http://derickrethans.nl/
International PHP Magazine                          http://php-mag.net/
-------------------------------------------------------------------------

Dennis Sterzenbach

22 years ago

>
> You can either use function_exists() to check if a function is
> available, or use "ini_get('disabled_functions')".
>
> Derick
>

function_exists() NEVER informs about the function  being
disabled or not it does inform about (I cite the manual here:)
"if the given function has been defined".

So it does NOT tell me anything about state.

If you had read my post, you knew I already do like you telling
me, but do not agree with this solution, as it is better
in performance etc. (see my post) to let PHP do so.
Also it isn't consequent to have info about existance of a func
but not about its disabled/enabled state.

Regards
Dennis

Derick Rethans

22 years ago

On Wed, 1 Oct 2003, Dennis Sterzenbach wrote:

> >
> > You can either use function_exists() to check if a function is
> > available, or use "ini_get('disabled_functions')".
> >
> > Derick
> >
> function_exists() NEVER informs about the function  being
> disabled or not it does inform about (I cite the manual here:)
> "if the given function has been defined".
>
> So it does NOT tell me anything about state.

Of course... why do you NEED to know if it's not available or
disabled... the result is the same: you can not use the function.

> If you had read my post, you knew I already do like you telling
> me, but do not agree with this solution, as it is better
> in performance etc. (see my post) to let PHP do so.

I did read it, I just don't see any point why it is useful.

Derick

--
"Interpreting what the GPL actually means is a job best left to those
that read the future by examining animal entrails."
-------------------------------------------------------------------------
Derick Rethans                                 http://derickrethans.nl/
International PHP Magazine                          http://php-mag.net/
-------------------------------------------------------------------------

Dennis Sterzenbach

22 years ago

> Of course... why do you NEED to know if it's not available or
> disabled... the result is the same: you can not use the function.
>

Sure.
But still it is a difference if my code is stable or not. Using an
own implementation telling about the disabled state makes it stable.
Also code should be performant. It isn't when reading a list of
comma seperated function names to a string, afterwards checking if
strpos() !== false.
I bet ZendEngine knows about all disabled functions, as it should to
block the usage. Also I bet it doesn't read the list each time a
function gets called, neither per request to some script.

So the list is persistant, access per C code.
And the performance and safety is layed down to PHP.
IMHO that's more performant, more secure and even more professional.

> > If you had read my post, you knew I already do like you telling
> > me, but do not agree with this solution, as it is better
> > in performance etc. (see my post) to let PHP do so.
>
> I did read it, I just don't see any point why it is useful.

Sorry for the tone, didn't want to be rough.

I hope you agree with my statement, now.

Regards
Dennis

Dennis Sterzenbach

22 years ago

Oh and what about having disabled the ini_get/ini_set methods:

<?php
print ini_get('disable_functions');
?>
Warning: ini_get,ini_set() has been disabled for security reasons

That's making the problem quite enormous.

Dennis

Unnamed Person

22 years ago

Hi,

> Oh and what about having disabled the ini_get/ini_set methods:
> ...
> print ini_get('disable_functions');
> ...
> Warning: ini_get,ini_set() has been disabled for security reasons

This won't work in PHP 5.0 because it comes with print/echo disabled
by default for security reasons.

This will help getting rid of XSS vulnerabilities and unwanted
errormessages.

Just for your information.

Stefan

Derick Rethans

22 years ago

On Wed, 1 Oct 2003 se@nopiracy.de wrote:

> > Oh and what about having disabled the ini_get/ini_set methods:
> > ...
> > print ini_get('disable_functions');
> > ...
> > Warning: ini_get,ini_set() has been disabled for security reasons
>
> This won't work in PHP 5.0 because it comes with print/echo disabled
> by default for security reasons.
>
> This will help getting rid of XSS vulnerabilities and unwanted
> errormessages.
>
> Just for your information.

What the hell are you talking about?

Derick

--
"Interpreting what the GPL actually means is a job best left to those
that read the future by examining animal entrails."
-------------------------------------------------------------------------
Derick Rethans                                 http://derickrethans.nl/
International PHP Magazine                          http://php-mag.net/
-------------------------------------------------------------------------

Unnamed Person

22 years ago

Hi Derick,

> What the hell are you talking about?

I thought it would be obvious that I was ironically criticizing
the idea of disabling ini_get etc... And that i was just kidding.

Stefan