<p>I don't claim to be a security expert, but I have ran a server for a number of years.  Keep in mind that whatever you do, running a public a server on the Internet is always going to put you at some risk, known security issue or not. </p>

<p>You're already making daily filesystem and mysql backups, right?</p>

<p>Just a cursory inspection of that list of functions, you're going to run into problems when Craft uses the filesystem, for example uploading assets, renaming files, etc. You should probably leave out:</p>

<p><code>move_uploaded_file, chdir, mkdir, rmdir, chmod, rename</code></p>

<p>The intention there a malicious attacker can't upload a file, move or rename it, and then execute it.</p>

<p>Craft already does an adequate job of filtering out nasty files so they don't get uploaded. If you want to go further, I'd recommend disallowing PHP to actually <a href="https://security.stackexchange.com/a/80342">run code</a> in any of your asset upload directories since those are probably going to be above the web root.</p>

<p>I just did a <a href="https://github.com/pixelandtonic/Craft-Release/search?utf8=%E2%9C%93&amp;q=shell_exec&amp;type=Code" rel="nofollow noreferrer">search</a> of the rest of the functions; <code>phpinfo</code> is used also used the control panel. I don't think that <a href="https://stackoverflow.com/a/3196153/4965912">poses as much of a threat</a>. Even if an attacker knows some file system paths, if it he can't write to them, he's DOA.</p>

<p>I'm also a fan of <a href="http://php.net/manual/en/ini.core.php#ini.open-basedir%60%60" rel="nofollow noreferrer">open_basedir</a>. It's a cheap form of "jailing" the web application inside a specific root. I run PHP-FPM which you can setup per pool, per user to make things a little more secure as well. </p>

CC BY-SA 3.0
2016-04-07T00:36:29.117Z
Yeah, your answer is way better.
Brad Bell
CC BY-SA 3.0
2016-04-07T00:37:02.710Z
I think we were writing at the same time, you beat me to it!
RitterKnight
CC BY-SA 3.0
2016-04-07T00:30:44.580Z
2016-04-07T00:30:44.580Z
2017-05-23T12:38:53.957Z
RitterKnight
<p>I'm not aware of a definitive list, but Craft have problems running with some of the methods in your list disabled.</p>

<pre><code>phpinfo, move_uploaded_file, chdir, mkdir, rmdir, chmod, rename
</code></pre>

<p>Any plugins you have installed might have additional function requirements as well.</p>

CC BY-SA 3.0
2016-04-07T00:25:04.377Z
2016-04-07T03:49:36.460Z
2016-04-07T03:49:36.460Z
Brad Bell
<p>The <code>php.ini</code> file has an option called <code>disable_functions</code>. You can add unsafe functions to it so that they cannot be run. Does anyone have any guidelines for a good setup with Craft for this. I realize that this is somewhat sort of subjective, but I'm sure there are some features that could without a doubt be turned off that Craft will never use.</p>

<p>OWASP suggests the below settings. Any thoughts on this?</p>

<blockquote>
  <p>disable_functions = "system, exec, shell_exec, passthru, phpinfo, show_source, popen, proc_open, fopen_with_path, dbmopen, dbase_open, putenv, move_uploaded_file, chdir, mkdir, rmdir, chmod, rename, filepro, filepro_rowcount, filepro_retrieve, posix_mkfifo"</p>
</blockquote>

CC BY-SA 3.0
2016-04-06T21:40:07.447Z
Are you trying to make it more resource efficient or have you experienced (security?) problems with exposed functions in the past?
Matt P
CC BY-SA 3.0
2016-04-06T21:49:13.160Z
Trying to harden the server a bit more to lock down potentially unknown security issues.
Davin Studer
<php>
Disabling unused PHP functions and Craft
# Disabling unused PHP functions and Craft

(Asked by: username_0 on 2016-04-06)

The `php.ini` file has an option called `disable_functions`. You can add unsafe functions to it so that they cannot be run. Does anyone have any guidelines for a good setup with Craft for this. I realize that this is somewhat sort of subjective, but I'm sure there are some features that could without a doubt be turned off that Craft will never use.

OWASP suggests the below settings. Any thoughts on this?

> disable\_functions = "system, exec, shell\_exec, passthru, phpinfo, show\_source, popen, proc\_open, fopen\_with\_path, dbmopen, dbase\_open, putenv, move\_uploaded\_file, chdir, mkdir, rmdir, chmod, rename, filepro, filepro\_rowcount, filepro\_retrieve, posix\_mkfifo"

**Tags:** php
> **Comments:**
> **username_1**: Are you trying to make it more resource efficient or have you experienced (security?) problems with exposed functions in the past?  
> **username_0**: Trying to harden the server a bit more to lock down potentially unknown security issues.  

---

## 2 answers

### Answer by username_2 on 2016-04-07. Score: 3 | Accepted answer

I don't claim to be a security expert, but I have ran a server for a number of years. Keep in mind that whatever you do, running a public a server on the Internet is always going to put you at some risk, known security issue or not.

You're already making daily filesystem and mysql backups, right?

Just a cursory inspection of that list of functions, you're going to run into problems when Craft uses the filesystem, for example uploading assets, renaming files, etc. You should probably leave out:

`move_uploaded_file, chdir, mkdir, rmdir, chmod, rename`

The intention there a malicious attacker can't upload a file, move or rename it, and then execute it.

Craft already does an adequate job of filtering out nasty files so they don't get uploaded. If you want to go further, I'd recommend disallowing PHP to actually [run code](https://security.stackexchange.com/a/80342) in any of your asset upload directories since those are probably going to be above the web root.

I just did a [search](https://github.com/pixelandtonic/Craft-Release/search?utf8=%E2%9C%93&q=shell_exec&type=Code) of the rest of the functions; `phpinfo` is used also used the control panel. I don't think that [poses as much of a threat](https://stackoverflow.com/a/3196153/4965912). Even if an attacker knows some file system paths, if it he can't write to them, he's DOA.

I'm also a fan of [open\_basedir](http://php.net/manual/en/ini.core.php#ini.open-basedir%60%60). It's a cheap form of "jailing" the web application inside a specific root. I run PHP-FPM which you can setup per pool, per user to make things a little more secure as well.

> **Comments:**
> **username_3**: Yeah, your answer is way better.  
> **username_2**: I think we were writing at the same time, you beat me to it!  

---

### Answer by username_3 on 2016-04-07. Score: 3

I'm not aware of a definitive list, but Craft have problems running with some of the methods in your list disabled.
phpinfo, move_uploaded_file, chdir, mkdir, rmdir, chmod, rename

Any plugins you have installed might have additional function requirements as well.


---

